File name: | Radic.exe |
Full analysis: | https://app.any.run/tasks/c01274d4-999f-42c4-b790-ad31ad1b6761 |
Verdict: | Malicious activity |
Analysis date: | October 04, 2022, 21:02:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | BB2F48B69ABD46648A761792B2897D97 |
SHA1: | 85D1258E9A79AE070F7988424BBD70C2A3297F46 |
SHA256: | 0C8F8CD027232CD9FC15C4045CCD9B94FEE33DF10F9B9778168F8148B23AFE52 |
SSDEEP: | 24576:nQtPrAxYQ3BjTHhNqQk97dkaZf/4sr4akMgRxHbeE8hdFelnFHDqlKah6T9dx:nQPrtIZzh6dkaZf/58fRxS38ooh |
.dll | | | Win32 Dynamic Link Library (generic) (38.3) |
---|---|---|
.exe | | | Win32 Executable (generic) (26.2) |
.exe | | | Win16/32 Executable Delphi generic (12) |
.exe | | | Generic Win/DOS Executable (11.6) |
.exe | | | DOS Executable Generic (11.6) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2022-Jul-30 18:57:07 |
Comments: | The launcher for the Radic GTA 5 Mod Menu! |
CompanyName: | - |
FileDescription: | Radic Launcher |
FileVersion: | 1.0.0.0 |
InternalName: | Radic Launcher.exe |
LegalCopyright: | Copyright © 2022 |
LegalTrademarks: | Radic Development |
OriginalFilename: | Radic Launcher.exe |
ProductName: | Radic Launcher |
ProductVersion: | 1.0.0.0 |
Assembly Version: | 1.0.0.0 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2022-Jul-30 18:57:07 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
\x14>&Z\x1a\x0f\x054 | 8192 | 1476824 | 1477120 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.99987 |
.text | 1490944 | 49856 | 50176 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.25836 |
.rsrc | 1548288 | 143163 | 143360 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.49154 |
Section_4 | 1695744 | 16 | 512 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0.142636 |
.reloc | 1703936 | 12 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.0980042 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 7.97693 | 38289 | UNKNOWN | UNKNOWN | RT_ICON |
2 | 3.60671 | 67624 | UNKNOWN | UNKNOWN | RT_ICON |
3 | 3.85449 | 16936 | UNKNOWN | UNKNOWN | RT_ICON |
4 | 4.02369 | 9640 | UNKNOWN | UNKNOWN | RT_ICON |
5 | 4.26712 | 4264 | UNKNOWN | UNKNOWN | RT_ICON |
6 | 4.5984 | 1128 | UNKNOWN | UNKNOWN | RT_ICON |
32512 | 2.79908 | 90 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
1 (#2) | 3.33212 | 960 | UNKNOWN | UNKNOWN | RT_VERSION |
1 (#3) | 5.09263 | 3683 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3024 | "C:\Users\admin\AppData\Local\Temp\Radic.exe" | C:\Users\admin\AppData\Local\Temp\Radic.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Radic Launcher Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
476 | "C:\Users\admin\AppData\Local\Temp\Radic.exe" | C:\Users\admin\AppData\Local\Temp\Radic.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Description: Radic Launcher Version: 1.0.0.0 Modules
| |||||||||||||||
2076 | "C:\Program Files\Internet Explorer\iexplore.exe" https://radicmenu.xyz/genlicense/s1 | C:\Program Files\Internet Explorer\iexplore.exe | Radic.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2692 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2076 CREDAT:275457 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30988340 | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30988340 | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2076) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2692 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar77F3.tmp | cat | |
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4 | SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55 | |||
2692 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:D15AAA7C9BE910A9898260767E2490E1 | SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E | |||
2076 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:B8BDA0B382A7D056A4241B388338B778 | SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2 | |||
2692 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab77F4.tmp | compressed | |
MD5:D15AAA7C9BE910A9898260767E2490E1 | SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E | |||
2692 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75814BCBAD95318DB3AF65FBC2678EB9 | der | |
MD5:CE7F03B567D286D48E39D397037A5AB9 | SHA256:DE73348D39C7B8CC436A7653083E0425E73EEF9D14D16B0129F23D00E86FD760 | |||
2692 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\challenges[1].css | text | |
MD5:EF0998BF10441C0DC0DCB132BDFBDC1A | SHA256:FAA67D3B2B2220DC526C921C1FC47DF5B956559A293D5E07FBAF58A52462F6BD | |||
2692 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:91F3D54560E8CBF7EB69142EAC627A27 | SHA256:88E46E6C867E55CE449734DEB49C44ABBD8C9A1D394985802650E56C818F5C97 | |||
2692 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar77F5.tmp | cat | |
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4 | SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55 | |||
2692 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab77F2.tmp | compressed | |
MD5:D15AAA7C9BE910A9898260767E2490E1 | SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E | |||
2692 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:788A873F5DF21839F4FF7C250AB54088 | SHA256:5B1CECADBE965FAFC941FEE8111B8C8A4649F5DE1A32DB04E3FEB76D5A705CD4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2692 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?66718e852d72a2c1 | US | compressed | 60.9 Kb | whitelisted |
2692 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e21de2ed86390e33 | US | compressed | 60.9 Kb | whitelisted |
2692 | iexplore.exe | GET | 200 | 184.24.77.67:80 | http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgQ9fEKDFEefMknhB07YBJLlyg%3D%3D | US | der | 346 b | whitelisted |
2076 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2692 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c4030856f5854bae | US | compressed | 60.9 Kb | whitelisted |
2076 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
2692 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?68eb1c49322ba3b9 | US | compressed | 4.70 Kb | whitelisted |
2692 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bef54d0e759156ea | US | compressed | 4.70 Kb | whitelisted |
2692 | iexplore.exe | GET | 200 | 96.16.145.230:80 | http://x1.c.lencr.org/ | US | der | 717 b | whitelisted |
2692 | iexplore.exe | GET | 200 | 96.16.145.230:80 | http://x2.c.lencr.org/ | US | der | 300 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2692 | iexplore.exe | 96.16.145.230:80 | x1.c.lencr.org | AKAMAI-AS | DE | suspicious |
2692 | iexplore.exe | 188.114.97.3:443 | radicmenu.xyz | CLOUDFLARENET | NL | malicious |
2692 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
2076 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2076 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
2692 | iexplore.exe | 184.24.77.67:80 | e1.o.lencr.org | Akamai International B.V. | DE | unknown |
2076 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
radicmenu.xyz |
| malicious |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
x2.c.lencr.org |
| whitelisted |
e1.o.lencr.org |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2692 | iexplore.exe | Potentially Bad Traffic | ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz) |
2692 | iexplore.exe | Potentially Bad Traffic | ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz) |