File name:

MOD MENU GTA 5.rar

Full analysis: https://app.any.run/tasks/0277b5cf-af15-40f5-bc67-34bac4bd9735
Verdict: Malicious activity
Threats:

RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware.

Malware Trends Tracker     >>>
Analysis date: December 24, 2023, 16:27:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
redline
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

546571914DAD3A425FB68F21FF90EC38

SHA1:

55A0EECBB5EA5974AEAB03C8F85FC4DA608E1261

SHA256:

5BD68552F0AC5D6B53F009CF821A3960C0B470E3768EC8834314F0641E30AB07

SSDEEP:

98304:w2bzlDpdy5SluBGT1uCumCC+dWfwFmEsJkt+7fZYgiv2Tr3st9evpz6g9s3dhiwt:DO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REDLINE has been detected (SURICATA)

      • modest-menu.exe (PID: 480)

    • Steals credentials from Web Browsers

      • modest-menu.exe (PID: 480)

    • Actions looks like stealing of personal data

      • modest-menu.exe (PID: 480)

    • Create files in the Startup directory

      • modest-menu.exe (PID: 480)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 124)

    • Reads browser cookies

      • modest-menu.exe (PID: 480)

    • Searches for installed software

      • modest-menu.exe (PID: 480)

    • Connects to unusual port

      • modest-menu.exe (PID: 480)

    • Reads the Internet Settings

      • modest-menu.exe (PID: 480)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 124)
      • modest-menu.exe (PID: 480)

    • Checks supported languages

      • qemu-ga.exe (PID: 1832)
      • modest-menu.exe (PID: 480)

    • Reads the computer name

      • qemu-ga.exe (PID: 1832)
      • modest-menu.exe (PID: 480)

    • Manual execution by a user

      • modest-menu.exe (PID: 480)
      • taskmgr.exe (PID: 1732)

    • Reads product name

      • modest-menu.exe (PID: 480)

    • Reads the machine GUID from the registry

      • modest-menu.exe (PID: 480)

    • Reads Environment values

      • modest-menu.exe (PID: 480)

    • Creates files or folders in the user directory

      • modest-menu.exe (PID: 480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #REDLINE modest-menu.exe qemu-ga.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MOD MENU GTA 5.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
480"C:\Users\admin\Desktop\MOD MENU GTA 5\modest-menu.exe" C:\Users\admin\Desktop\MOD MENU GTA 5\modest-menu.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\mod menu gta 5\modest-menu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1732"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1832"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe—modest-menu.exe
User:
admin
Integrity Level:
MEDIUM
Description:
qemu-ga
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\qemu-ga.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
4 462
Read events
4 432
Write events
30
Delete events
0

Modification events

(PID) Process:(124) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(124) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
11
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\modest-menu.exe —
MD5:—
SHA256:—
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\tcpbidi.xmlxml
MD5:31B010EF50D54D548B4B8B211F421318
SHA256:173B245285FA80B85108F62DB48C5ADF4B0EABF52B4627D6998EF14A1909D7BB
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\db.logbinary
MD5:4230F1935F5D301A15F710129B659F0A
SHA256:2CC1AE948F5EBE7E43BE8D6854FFDD421C569A25326337B0028D3CEDAB7F0184
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\ScavengeSpace.xmlxml
MD5:5C18CD22BE4628865FCB63337A6E5EF6
SHA256:C67A772F5FA711011E0D015D2DDE69F891B52819CF8FAD5248E492DECA2ACA4B
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\x32\Qt5Gui.dllexecutable
MD5:D9B78F4B2F8F393C8854C7CC95EAE5D8
SHA256:55FAEBB8F5E28CDE50F561BBD2638DB7EDCFD26E7EE7B975E0049B113145AE38
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\data.logbinary
MD5:6EF58127BF94AF4BAA0C63A9CBECF295
SHA256:4973E763D5F0346A55CEAE956850D4960BE79FF90B960A60F8B4A319331FA748
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\DATA\Settings\Environment.initext
MD5:EFF856F44BBF8DF26BFF2BBF61A5A62D
SHA256:CB63DEA186E72609A066EF18F80F3FBB8A6276758F1FA20B3E9858E683CDB8E0
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\enca.logbinary
MD5:1FC56D5A7300EE8949ABB7EBCA46B8CD
SHA256:FD43ECC8091B39E504D62786381EBB5E2526A540A38BB2BAEBDF5B4BDB310564
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\pol\NarratorControlTemplates.xmlxml
MD5:74FDEEAC0C0C0F62F4D0D484A36DA23A
SHA256:A927ED842EBA5E095FA2AAB97D6DB73DBF66C69CAD4FE68C5737D7A41286193F
124WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb124.26297\MOD MENU GTA 5\DATA\Settings\OBSettings.jsonbinary
MD5:8C0454C0B4EB0F60F45C7F699ABDBB47
SHA256:E8871FA446CB6C5A7D8535F10492A566767BF0CE06AB452A4397E41502862074
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
480
modest-menu.exe
45.15.156.186:29975
—
Galaxy LLC
RU
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
480
modest-menu.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
480
modest-menu.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)
480
modest-menu.exe
A Network Trojan was detected
ET MALWARE Redline Stealer Family Activity (Response)
480
modest-menu.exe
Successful Credential Theft Detected
SUSPICIOUS [ANY.RUN] Clear Text Password Exfiltration Atempt
480
modest-menu.exe
Successful Credential Theft Detected
SUSPICIOUS [ANY.RUN] Clear Text Password Exfiltration Atempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MOD MENU GTA 5.rar