Overview

overview

7

Static

static

3

RedLine Agent.exe

windows10-2004-x64

7

RedLine Agent.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    600s
  • max time network
    479s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 08:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RedLine Agent.exe
  • Size 68.8MB
  • Sample260808-kbkshsbr9v
  • SHA256 d5a65e448acaf7b6f08aa63a462f8b0deb50b86e6410fb30d285d5e0f6d6ed4f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 47 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RedLine Agent.exe
    "C:\Users\Admin\AppData\Local\Temp\RedLine Agent.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\RedLine Agent.exe
      "C:\Users\Admin\AppData\Local\Temp\RedLine Agent.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:204
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1396

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
          • Size 211KB
          • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hook-PyQt5.Qt3DExtras.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\hook-PyQt5.Qt3DExtras.py
          • Size 633B
          • SHA256 5287211c9e7572467fb325c9c9e2ccdbae124d45d1081fd152cbf7a0277a83df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hook-PyQt6.Qt3DExtras.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\hook-PyQt6.Qt3DExtras.py
          • Size 633B
          • SHA256 c7261094df2d79913d890f5e09b515284286ed0edf2a14a16f8b24aecd259476
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hook-PyQt6.QtOpenGLWidgets.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\hook-PyQt6.QtOpenGLWidgets.py
          • Size 633B
          • SHA256 d85f6a0f862a219aba0cc2917a09fb0c7bd2e84ab72169016b949189ed7537ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hook-PySide2.QtWebEngineWidgets.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\hook-PySide2.QtWebEngineWidgets.py
          • Size 633B
          • SHA256 f2fd53d6140e5fd8d20f7cbaac48b07443b2b6aa8d07b17119e8d76d590394c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __init__.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\pre_safe_import_module\__init__.py
          • Size 2B
          • SHA256 32c4858e22cc2c967b42150fa550562a2c839c2cebcaab91cabdf6f4da020022
          • MD5 SHA1 SHA512
          Submit Download

          hook-gi.repository.Champlain.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\pre_safe_import_module\hook-gi.repository.Champlain.py
          • Size 783B
          • SHA256 7397fbe0a78f507b7eedf1ffb4941fbaa078e32b184cb6c29bbeaed90541d3b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hook-inflect.py
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyInstaller\hooks\pre_safe_import_module\hook-inflect.py
          • Size 924B
          • SHA256 3b9eae501758fe37b78c6a71c16a3fab22870943d95fcd3969d6b0ae3f240411
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyQt5\Qt5\bin\MSVCP140.dll
          • Size 576KB
          • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyQt5\Qt5\bin\MSVCP140_1.dll
          • Size 30KB
          • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyQt5\Qt5\bin\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtCore.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyQt5\QtCore.pyd
          • Size 2.4MB
          • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sip.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\PyQt5\sip.cp311-win_amd64.pyd
          • Size 120KB
          • SHA256 406953b36fb04046c8d476d85a33a8829bb62e37804b08f0cf36f6c5529a904c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_asyncio.pyd
          • Size 63KB
          • SHA256 76db93bd64cb4a36edb37694456f89bb588db98cf2733eb436f000b309eec3b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_bz2.pyd
          • Size 82KB
          • SHA256 1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp311-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_cffi_backend.cp311-win_amd64.pyd
          • Size 174KB
          • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_ctypes.pyd
          • Size 121KB
          • SHA256 3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_decimal.pyd
          • Size 247KB
          • SHA256 23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_elementtree.pyd
          • Size 125KB
          • SHA256 b4a866a63316a04e070d25acc055a1e4db9071e8e9fb6fe9cde019a8ef311ed5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_hashlib.pyd
          • Size 63KB
          • SHA256 2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_lzma.pyd
          • Size 155KB
          • SHA256 663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_multiprocessing.pyd
          • Size 33KB
          • SHA256 3c5b0823e30810aee47fdfad567491bc33dd640c37e35c8600e75c5a8d05ce2a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_overlapped.pyd
          • Size 50KB
          • SHA256 4990f62e11c0a5ab15a9ffce9d054f06d0bc9213aea0c2a414a54fa01a5eb6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_queue.pyd
          • Size 31KB
          • SHA256 ac3b144d7d7c8ee39f29d8749c5a35c4314b5365198821605c883fd11807e766
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_socket.pyd
          • Size 77KB
          • SHA256 8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_ssl.pyd
          • Size 172KB
          • SHA256 591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_tkinter.pyd
          • Size 62KB
          • SHA256 a3488d90b5493dd0af5054750194cdeafbf05db42e881c78d92449932565308d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\_uuid.pyd
          • Size 24KB
          • SHA256 ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\base_library.zip
          • Size 1.4MB
          • SHA256 418aea465c0d7da101538f41ce7170363b74384f922a9c0426dc2e4da1de833c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\libssl-3.dll
          • Size 768KB
          • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\pyexpat.pyd
          • Size 193KB
          • SHA256 58b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\python3.DLL
          • Size 65KB
          • SHA256 920350a7c24c46339754e38d0db34ab558e891da0b3a389d5230a0d379bee802
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\python311.dll
          • Size 5.5MB
          • SHA256 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\pywin32_system32\pythoncom311.dll
          • Size 665KB
          • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\pywin32_system32\pywintypes311.dll
          • Size 132KB
          • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\select.pyd
          • Size 29KB
          • SHA256 fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\tcl86t.dll
          • Size 1.8MB
          • SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\tk86t.dll
          • Size 1.5MB
          • SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\unicodedata.pyd
          • Size 1.1MB
          • SHA256 f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI22082\win32\win32api.pyd
          • Size 135KB
          • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5444-1784-0x00007FFC1C870000-0x00007FFC1CD5C000-memory.dmp
          Download

          memory/5444-1777-0x00007FFC1D330000-0x00007FFC1D593000-memory.dmp
          Download

          memory/5444-1785-0x00007FFC1B640000-0x00007FFC1B8A5000-memory.dmp
          Download

          memory/5444-1786-0x0000024385F00000-0x0000024385F10000-memory.dmp
          Download