File name:	FilmoraInstaller.scr
Full analysis:	https://app.any.run/tasks/03ecbb8a-c766-4581-a011-c63e1963faaf
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	May 06, 2022, 08:36:47
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan rat redline
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	3E4CBD414D6CE2B551F22C65F27CB41D
SHA1:	8C725FAFA6EDF3881DFACAC9BD26FB68136E5021
SHA256:	00CFCBB209EDD6130EEB5EB11BC50832A50AC4A463F5AD48C292458BB161DA2E
SSDEEP:	24576:ZrXE6TL3u0ojEsRpvNk5w82b+zhkHEgyFJvg4+WI4AsQznH7SfD1dEv2FxfeygaW:Z7EUogsfNr8zOHgfjAdTOMv2FxfeygaW

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1970:01:01 01:12:07+01:00
PEType:	PE32
LinkerVersion:	85.29
CodeSize:	1223680
InitializedDataSize:	147456
UninitializedDataSize:	-
EntryPoint:	0xa5c4
OSVersion:	6
ImageVersion:	37
SubsystemVersion:	6
Subsystem:	Windows GUI

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	01-Jan-1970 00:12:07
Detected languages:	English - United States
Debug artifacts:	Embedded COFF debugging symbols

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x000000F0

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	6
Time date stamp:	01-Jan-1970 00:12:07
Pointer to Symbol Table:	0x000003D8
Number of symbols:	584
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
DPY6t	0x00001000	0x00024665	0x00024800	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.58167
1HzAhCo	0x00026000	0x00106331	0x00106400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	5.6993
LR8cta	0x0012D000	0x0001F1F0	0x0001F200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.14858
O9NVa	0x0014D000	0x00001D10	0x00001000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.05044
idpboc	0x0014F000	0x00002E00	0x00002E00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.70199
NaDEc	0x00152000	0x000001D5	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.70436

PID	CMD	Path	Indicators	Parent process
3096	"C:\Users\admin\Downloads\FilmoraInstaller.scr" /S	C:\Users\admin\Downloads\FilmoraInstaller.scr	—	Explorer.EXE
User: admin Integrity Level: MEDIUM Exit code: 0
3312	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe		FilmoraInstaller.scr
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET ClickOnce Launch Utility Exit code: 0 Version: 4.0.30319.34209 built by: FX452RTMGDR RedLine (PID) Process(3312) AppLaunch.exe C2 (1)diosadbauas.tk:20856 Botnet5004616587 Err_msg Auth_value8fc25c7321216a94ae01f5d0435f5b26 US (163) LEnvironmentogiEnvironmentn DatEnvironmenta Environment WSystem.Texteb DatSystem.Texta System.Text CoCryptographyokieCryptographys Cryptography ExtGenericension CooGenerickies Generic OFileInfopeFileInfora GFileInfoX StabFileInfole FileInfo OpLinqera GLinqX Linq ApGenericpDaGenericta\RGenericoamiGenericng\ Network Extension UNKNOWN . 1 cFileStreamredFileStreamit_cFileStreamardFileStreams FileStream \ Network\ Host Port : User Pass cookies.sqlite %USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal Dispose String.Replace String.Remove bcrFileStream.IOypt.dFileStream.IOll FileStream.IO BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder string.Empty BCruintyptCloseAlgorituinthmProvuintider uint BCrUnmanagedTypeyptDecrUnmanagedTypeypt UnmanagedType BCrbyte[]yptDesbyte[]troyKbyte[]ey byte[] BCpszPropertyryptGepszPropertytPropepszPropertyrty pszProperty BCEncodingryptSEncodingetPrEncodingoperEncodingty Encoding BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey bMasterKey windows-1251 AES Microsoft Primitive Provider ChainingModeGCM AuthTagLength ChainingMode ObjectLength KeyDataBlob - {0} net.tcp:// / localhost 8fc25c7321216a94ae01f5d0435f5b26 Authorization ns1 UNKNWON HjIOHwxBLx8gKTNTMDc+HBA+N0MvAy5HJyAgeQ== 5004616587 Dubiosity Yandex\YaAddon ToString asf wallet ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu... _ T e l gr am ex \TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata String Replace string.Replace %USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng File.Write Handler npvo* %USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl serviceInterface.Extension ProldCharotonVoldCharPN oldChar nSystem.CollectionspvoSystem.Collections* System.Collections ( UNIQUE cstringmstringd string /ProcessC Process Process \| " Armenia Azerbaijan Belarus Kazakhstan Kyrgyzstan Moldova Tajikistan Uzbekistan Ukraine Russia gasdl94ja;sdiasdl94ja;s32 asdl94ja;s Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds asdl94jlajsd Width Height CopyFromScreen https://api.ip.sb/ip 80 81 0.0.0.0 SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor System.Windows.Forms Name NumberOfCores roSystem.Linqot\CISystem.LinqMV2 System.Linq SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller AdapterRAM SOFTWARE\WOW6432Node\Clients\StartMenuInternet SOFTWARE\Clients\StartMenuInternet shell\open\command Unknown Version SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente System.Management SerialNumber SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId=' ' FileSystem SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId=' System. ExecutablePath [ ] Concat0 MConcatb oConcatr Concat0 Concat SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem Memory {0}{1}{2} x32 x64 x86 SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductName CSDVersion Unknown _[


(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(3312) AppLaunch.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:	write	Name:	ConsoleTracingMask
Value:

PID	Process	IP	Domain	ASN	CN	Reputation
3312	AppLaunch.exe	51.68.141.111:443	oshi.at	—	GB	suspicious
3312	AppLaunch.exe	95.181.164.53:20856	diosadbauas.tk	QWARTA LLC	RU	malicious


KERNEL32.dll
USER32.dll

Domain	IP	Reputation
diosadbauas.tk	95.181.164.53	malicious
oshi.at	51.68.141.111	suspicious
dns.msftncsi.com	131.107.255.255	shared

General Info

FilmoraInstaller.scr

3E4CBD414D6CE2B551F22C65F27CB41D

8C725FAFA6EDF3881DFACAC9BD26FB68136E5021

00CFCBB209EDD6130EEB5EB11BC50832A50AC4A463F5AD48C292458BB161DA2E

24576:ZrXE6TL3u0ojEsRpvNk5w82b+zhkHEgyFJvg4+WI4AsQznH7SfD1dEv2FxfeygaW:Z7EUogsfNr8zOHgfjAdTOMv2FxfeygaW

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

REDLINE detected by memory dumps

Connects to CnC server

REDLINE was detected

Steals credentials from Web Browsers

Actions looks like stealing of personal data

SUSPICIOUS

Checks supported languages

Reads the computer name

Reads Environment values

Reads the cookies of Mozilla Firefox

Reads the cookies of Google Chrome

Searches for installed software

INFO

Malware configuration

RedLine

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Malware configuration

RedLine

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings