Edit tour

Windows Analysis Report
Implosions.exe

Overview

General Information

Sample name:	Implosions.exe
Analysis ID:	1639986
MD5:	1de3d44fc259e585d924d872d8224972
SHA1:	d81dc1f25ea3df6dc4d2fb6520491721594fbe96
SHA256:	3ef92d70a248a8e1b1cda278e99f80fa7e66c6c89cbb90c6d3b295faff061b5a
Tags:	exeuser-BastianHein
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Implosions.exe (PID: 6364 cmdline: "C:\Users\user\Desktop\Implosions.exe" MD5: 1DE3D44FC259E585D924D872D8224972)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["209.38.151.4:55123"], "Bot Id": "vex4you"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Implosions.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Implosions.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Implosions.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
Implosions.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Implosions.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: Implosions.exe PID: 6364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Implosions.exe PID: 6364	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Implosions.exe PID: 6364	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x6a51:$a4: get_ScannedWallets 0x58f8:$a5: get_ScanTelegram 0x66da:$a6: get_ScanGeckoBrowsersPaths 0x458b:$a7: <Processes>k__BackingField 0x1abe:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3ebf:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Implosions.exe.2f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Implosions.exe.2f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.Implosions.exe.2f0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.Implosions.exe.2f0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.Implosions.exe.2f0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

Suricata Signatures

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:57:11.193787+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49682	209.38.151.4	55123	TCP
2025-03-16T19:57:17.801349+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49683	209.38.151.4	55123	TCP
2025-03-16T19:57:24.583200+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49684	209.38.151.4	55123	TCP
2025-03-16T19:57:31.217197+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49690	209.38.151.4	55123	TCP
2025-03-16T19:57:37.840316+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49691	209.38.151.4	55123	TCP
2025-03-16T19:57:44.479821+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49692	209.38.151.4	55123	TCP
2025-03-16T19:57:51.090868+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49696	209.38.151.4	55123	TCP
2025-03-16T19:57:57.695871+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49699	209.38.151.4	55123	TCP
2025-03-16T19:58:04.306340+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49700	209.38.151.4	55123	TCP
2025-03-16T19:58:10.922094+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49702	209.38.151.4	55123	TCP
2025-03-16T19:58:17.506258+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49703	209.38.151.4	55123	TCP
2025-03-16T19:58:24.120709+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49704	209.38.151.4	55123	TCP
2025-03-16T19:58:30.733658+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49705	209.38.151.4	55123	TCP
2025-03-16T19:58:37.340576+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49706	209.38.151.4	55123	TCP
2025-03-16T19:58:43.966020+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49707	209.38.151.4	55123	TCP
2025-03-16T19:58:50.725226+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49708	209.38.151.4	55123	TCP
2025-03-16T19:58:57.320546+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49709	209.38.151.4	55123	TCP
2025-03-16T19:59:03.915634+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49710	209.38.151.4	55123	TCP
2025-03-16T19:59:10.509319+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.8	49711	209.38.151.4	55123	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:57:11.193787+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49682	209.38.151.4	55123	TCP
2025-03-16T19:57:17.801349+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49683	209.38.151.4	55123	TCP
2025-03-16T19:57:24.583200+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49684	209.38.151.4	55123	TCP
2025-03-16T19:57:31.217197+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49690	209.38.151.4	55123	TCP
2025-03-16T19:57:37.840316+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49691	209.38.151.4	55123	TCP
2025-03-16T19:57:44.479821+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49692	209.38.151.4	55123	TCP
2025-03-16T19:57:51.090868+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49696	209.38.151.4	55123	TCP
2025-03-16T19:57:57.695871+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49699	209.38.151.4	55123	TCP
2025-03-16T19:58:04.306340+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49700	209.38.151.4	55123	TCP
2025-03-16T19:58:10.922094+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49702	209.38.151.4	55123	TCP
2025-03-16T19:58:17.506258+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49703	209.38.151.4	55123	TCP
2025-03-16T19:58:24.120709+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49704	209.38.151.4	55123	TCP
2025-03-16T19:58:30.733658+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49705	209.38.151.4	55123	TCP
2025-03-16T19:58:37.340576+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49706	209.38.151.4	55123	TCP
2025-03-16T19:58:43.966020+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49707	209.38.151.4	55123	TCP
2025-03-16T19:58:50.725226+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49708	209.38.151.4	55123	TCP
2025-03-16T19:58:57.320546+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49709	209.38.151.4	55123	TCP
2025-03-16T19:59:03.915634+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49710	209.38.151.4	55123	TCP
2025-03-16T19:59:10.509319+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.8	49711	209.38.151.4	55123	TCP

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000266F000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.38.151.4:55123
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.38.151.4:55123/
Source: Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000267C000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Implosions.exe, 00000000.00000002.2080515452.000000000266F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000267C000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Implosions.exe, 00000000.00000002.2080515452.000000000267C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectLR
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: Implosions.exe, 00000000.00000002.2080515452.000000000266F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectT
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsLR
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesLR
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentLR
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateLR
Source: Implosions.exe, 00000000.00000002.2080515452.00000000026AF000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.0000000002685000.00000004.00000800.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2080515452.000000000279A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: Implosions.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: Implosions.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: Implosions.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%

System Summary

Malicious sample detected (through community Yara rule)

Source: Implosions.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Implosions.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: Implosions.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: Implosions.exe PID: 6364, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\Implosions.exe	Code function: 0_2_00B3E7B0		0_2_00B3E7B0
Source: C:\Users\user\Desktop\Implosions.exe	Code function: 0_2_00B3DC90		0_2_00B3DC90

Source: Implosions.exe, 00000000.00000002.2078994669.00000000007AE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Implosions.exe

Source: Implosions.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Implosions.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Implosions.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: Implosions.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: Implosions.exe PID: 6364, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.winEXE@2/0@0/1

Source: C:\Users\user\Desktop\Implosions.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03

Source: Implosions.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Implosions.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Implosions.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Implosions.exe	Virustotal: Detection: 83%
Source: Implosions.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\Implosions.exe "C:\Users\user\Desktop\Implosions.exe"
Source: C:\Users\user\Desktop\Implosions.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: Implosions.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Implosions.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oHC:\Windows\System.ServiceModel.pdb source: Implosions.exe, 00000000.00000002.2078713458.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: o.pdbService source: Implosions.exe, 00000000.00000002.2078713458.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb0 source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdbb source: Implosions.exe, 00000000.00000002.2078994669.0000000000889000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp, Implosions.exe, 00000000.00000002.2082185598.0000000005E52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb, source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp

Source: Implosions.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 55123

Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Implosions.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Memory allocated: 25D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Memory allocated: 45D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Implosions.exe TID: 6388

Thread sleep time: -75000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Implosions.exe, 00000000.00000002.2078994669.0000000000810000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Implosions.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Implosions.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Users\user\Desktop\Implosions.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Implosions.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Implosions.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: Implosions.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Implosions.exe PID: 6364, type: MEMORYSTR

Source: Yara match	File source: Implosions.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Implosions.exe PID: 6364, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: Implosions.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Implosions.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.837325917.00000000002F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Implosions.exe PID: 6364, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49710 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49710 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49692 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49692 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49699 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49699 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49711 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49711 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49702 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49702 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49683 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49683 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49705 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49705 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49682 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49682 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49690 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49690 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49691 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49691 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49708 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49708 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49706 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49706 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49684 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49684 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49700 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49700 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49704 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49704 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49696 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49696 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49703 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49703 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49707 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49707 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.8:49709 -> 209.38.151.4:55123
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.8:49709 -> 209.38.151.4:55123

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Implosions.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Source: Implosions.exe	Virustotal: Detection: 83%			Perma Link
Source: Implosions.exe	ReversingLabs: Detection: 86%

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 209.38.151.4:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 209.38.151.4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Implosions.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Implosions.exe