File name:

Galaxy Swapper v2.exe

Full analysis: https://app.any.run/tasks/7d1b1ddd-2629-43b1-8fc9-88386b7c586b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 12, 2024, 06:35:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
redline
kelihos
trojan
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

DE662C216C9CBEA5B53AD30D412D606E

SHA1:

0D7D74B5F9B401DFC5C8CD3F34E275E57D042E63

SHA256:

1FD12B4B8AF2ECD380B8FA3CBBD97C1B1B33BE6902EC5D6ECBB3BD536B482BDA

SSDEEP:

12288:+cSXm2+pPeyPodRxQlTztbWLd8GWWVmpugf2tr6d0GHui0TXdKex:+gZGqodRxQlTztbW58GW4tr5Qui0TYc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • runas.exe (PID: 3700)
      • Galaxy Swapper v2.exe (PID: 2752)
      • conhost.exe (PID: 2156)

    • Steals credentials from Web Browsers

      • Galaxy Swapper v2.exe (PID: 2752)
      • Galaxy Swapper v2.exe (PID: 3488)

    • REDLINE has been detected (SURICATA)

      • Galaxy Swapper v2.exe (PID: 2752)
      • Galaxy Swapper v2.exe (PID: 3488)

    • Connects to the CnC server

      • Galaxy Swapper v2.exe (PID: 2752)
      • Galaxy Swapper v2.exe (PID: 3488)

    • KELIHOS has been detected (SURICATA)

      • Galaxy Swapper v2.exe (PID: 2752)

    • Actions looks like stealing of personal data

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)

    • REDLINE has been detected (YARA)

      • Galaxy Swapper v2.exe (PID: 2752)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Galaxy Swapper v2.exe (PID: 2752)
      • Galaxy Swapper v2.exe (PID: 3488)
      • cmd.exe (PID: 1352)
      • conhost.exe (PID: 2156)

    • The process creates files with name similar to system file names

      • Galaxy Swapper v2.exe (PID: 2752)

    • Process requests binary or script from the Internet

      • Galaxy Swapper v2.exe (PID: 2752)

    • Connects to the server without a host name

      • Galaxy Swapper v2.exe (PID: 2752)

    • Reads settings of System Certificates

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)

    • Executable content was dropped or overwritten

      • Galaxy Swapper v2.exe (PID: 2752)
      • conhost.exe (PID: 2156)

    • Searches for installed software

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)

    • Reads browser cookies

      • Galaxy Swapper v2.exe (PID: 3488)

    • Drops 7-zip archiver for unpacking

      • conhost.exe (PID: 2156)

    • Reads security settings of Internet Explorer

      • Galaxy Swapper v2.exe (PID: 2752)
      • conhost.exe (PID: 2156)

    • Executing commands from a ".bat" file

      • conhost.exe (PID: 2156)

    • Starts CMD.EXE for commands execution

      • conhost.exe (PID: 2156)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1352)

  • INFO

    • Manual execution by a user

      • Galaxy Swapper v2.exe (PID: 3488)

    • Reads the computer name

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)
      • svchost.exe (PID: 1808)
      • conhost.exe (PID: 2156)

    • Checks supported languages

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)
      • conhost.exe (PID: 2156)
      • svchost.exe (PID: 1808)
      • mode.com (PID: 2728)

    • Reads the machine GUID from the registry

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)

    • Reads Environment values

      • Galaxy Swapper v2.exe (PID: 2752)
      • Galaxy Swapper v2.exe (PID: 3488)

    • Reads product name

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)

    • Reads the software policy settings

      • Galaxy Swapper v2.exe (PID: 3488)
      • Galaxy Swapper v2.exe (PID: 2752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(2752) Galaxy Swapper v2.exe
C2 (1)45.15.156.167:80
Botnet@mass1vexdd
Options
ErrorMessageClick Close to exit the program. Error code: 1142
Keys
XorRateably
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:08 20:01:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.38
CodeSize: 72192
InitializedDataSize: 381952
UninitializedDataSize: -
EntryPoint: 0x44f2
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runas.exe no specs #REDLINE galaxy swapper v2.exe #REDLINE galaxy swapper v2.exe conhost.exe svchost.exe no specs cmd.exe no specs mode.com no specs attrib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352C:\Windows\system32\cmd.exe /c ""C:\Users\Administrator\AppData\Local\Temp\main\main.bat" /S"C:\Windows\System32\cmd.exe—conhost.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1808"C:\Users\ADMINI~1\AppData\Local\Temp\svchost.exe" C:\Users\Administrator\AppData\Local\Temp\svchost.exe—Galaxy Swapper v2.exe
User:
Administrator
Integrity Level:
HIGH
Description:
musical_rhythms_for_certain_actions
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\administrator\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2156"C:\Users\ADMINI~1\AppData\Local\Temp\conhost.exe" C:\Users\Administrator\AppData\Local\Temp\conhost.exe
Galaxy Swapper v2.exe
User:
Administrator
Company:
Brave Software, Inc.
Integrity Level:
HIGH
Description:
Brave Browser
Exit code:
0
Version:
95.1.31.87
Modules
Images
c:\users\administrator\appdata\local\temp\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2260attrib +H "IdXsAYepwNyor9pXCym14F9nUPSKx8f.exe"C:\Windows\System32\attrib.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2728mode 65,10C:\Windows\System32\mode.com—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2752"C:\Users\admin\Desktop\Galaxy Swapper v2.exe"C:\Users\admin\Desktop\Galaxy Swapper v2.exe
runas.exe
User:
Administrator
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\galaxy swapper v2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
RedLine
(PID) Process(2752) Galaxy Swapper v2.exe
C2 (1)45.15.156.167:80
Botnet@mass1vexdd
Options
ErrorMessageClick Close to exit the program. Error code: 1142
Keys
XorRateably
3488"C:\Users\admin\Desktop\Galaxy Swapper v2.exe" C:\Users\admin\Desktop\Galaxy Swapper v2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\galaxy swapper v2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3700"C:\Windows\System32\runas.exe" /user:administrator "C:\Users\admin\Desktop\Galaxy Swapper v2.exe"C:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
15 237
Read events
15 149
Write events
63
Delete events
25

Modification events

(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2752) Galaxy Swapper v2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Galaxy Swapper v2_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
4
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2752Galaxy Swapper v2.exeC:\Users\Administrator\AppData\Local\Temp\conhost.exeexecutable
MD5:BEF789367FD04A7347BE6FCC9DB33875
SHA256:3E26CCA96DFC289361A1D439F437B60A85C8398A1A200A18C9AB87679FF524D6
2156conhost.exeC:\Users\ADMINI~1\AppData\Local\Temp\main\KillDuplicate.cmdtext
MD5:68CECDF24AA2FD011ECE466F00EF8450
SHA256:64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
2156conhost.exeC:\Users\ADMINI~1\AppData\Local\Temp\main\main.battext
MD5:86230E6B384AC631B0E976DEFCA248D2
SHA256:CD06ED7EEEA2596E819EC3E70B75110D6BB27D8BD6009AB75C677D06A141F079
2156conhost.exeC:\Users\ADMINI~1\AppData\Local\Temp\main\file.bincompressed
MD5:808AA0ED773BF001B1F134B0A7346272
SHA256:E0521923C7B682AB812C470B3921F8828ADA5CED56C414B87606E53A49BE216C
2156conhost.exeC:\Users\ADMINI~1\AppData\Local\Temp\main\7z.dllexecutable
MD5:72491C7B87A7C2DD350B727444F13BB4
SHA256:34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
2752Galaxy Swapper v2.exeC:\Users\Administrator\AppData\Local\Temp\svchost.exeexecutable
MD5:089EB6AE543B129F0C1E109D91909DA2
SHA256:9FA53B063EDE5C4A7D1D54A6D296A04073854A7D990F2802C16016CA79D31DDF
1352cmd.exeC:\Users\Administrator\AppData\Local\Temp\main\file.zipcompressed
MD5:808AA0ED773BF001B1F134B0A7346272
SHA256:E0521923C7B682AB812C470B3921F8828ADA5CED56C414B87606E53A49BE216C
2156conhost.exeC:\Users\ADMINI~1\AppData\Local\Temp\main\7z.exeexecutable
MD5:619F7135621B50FD1900FF24AADE1524
SHA256:344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
1352cmd.exeC:\Users\Administrator\AppData\Local\Temp\main\file.bincompressed
MD5:808AA0ED773BF001B1F134B0A7346272
SHA256:E0521923C7B682AB812C470B3921F8828ADA5CED56C414B87606E53A49BE216C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
9
DNS requests
1
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2752
Galaxy Swapper v2.exe
GET
200
195.20.16.153:80
http://195.20.16.153/conhost.exe
unknown
executable
2.53 Mb
unknown
2752
Galaxy Swapper v2.exe
GET
200
195.20.16.153:80
http://195.20.16.153/svchost.exe
unknown
executable
4.90 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2752
Galaxy Swapper v2.exe
45.15.156.167:80
—
Galaxy LLC
RU
malicious
2752
Galaxy Swapper v2.exe
104.26.12.31:443
api.ip.sb
CLOUDFLARENET
US
unknown
3488
Galaxy Swapper v2.exe
45.15.156.167:80
—
Galaxy LLC
RU
malicious
2752
Galaxy Swapper v2.exe
195.20.16.153:80
—
—
—
unknown
3488
Galaxy Swapper v2.exe
104.26.12.31:443
api.ip.sb
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
api.ip.sb
  • 104.26.12.31
  • 172.67.75.172
  • 104.26.13.31
whitelisted

Threats

PID
Process
Class
Message
2752
Galaxy Swapper v2.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2752
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
2752
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
2752
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
2752
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
2752
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
3488
Galaxy Swapper v2.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
3488
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
3488
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
3488
Galaxy Swapper v2.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Galaxy Swapper v2.exe