analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

tradecheat.exe

Full analysis: https://app.any.run/tasks/6084d3f9-e45b-40ab-96bb-92f68073778f
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: January 24, 2022, 22:50:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
redline
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

73287415802EF1F46DC8AB0E42BD19E6

SHA1:

54FB4824C22F94ACDB4F1C412AF6602E97990F86

SHA256:

96ED2610E94B19233C22C2341BB36F340298D76BB36BF658A0D853B91E1ACC4E

SSDEEP:

98304:1y2ZuCBmjjENk3Aok/IK9zHcqN8ynr4/3:13Z74jwNk3AbfjNBr4/3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Connects to CnC server

      • AppLaunch.exe (PID: 3216)
    • REDLINE was detected

      • AppLaunch.exe (PID: 3216)
    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 3216)
    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 3216)
  • SUSPICIOUS

    • Reads the computer name

      • AppLaunch.exe (PID: 3216)
    • Checks supported languages

      • tradecheat.exe (PID: 4016)
      • AppLaunch.exe (PID: 3216)
    • Reads the cookies of Google Chrome

      • AppLaunch.exe (PID: 3216)
    • Reads the cookies of Mozilla Firefox

      • AppLaunch.exe (PID: 3216)
    • Reads Environment values

      • AppLaunch.exe (PID: 3216)
    • Executable content was dropped or overwritten

      • AppLaunch.exe (PID: 3216)
    • Drops a file with a compile date too recent

      • AppLaunch.exe (PID: 3216)
    • Searches for installed software

      • AppLaunch.exe (PID: 3216)
    • Drops a file with too old compile date

      • AppLaunch.exe (PID: 3216)
  • INFO

    • Reads settings of System Certificates

      • AppLaunch.exe (PID: 3216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x1bc000
UninitializedDataSize: -
InitializedDataSize: 179200
CodeSize: 140288
LinkerVersion: 14.29
PEType: PE32
TimeStamp: 2022:01:23 11:35:40+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-Jan-2022 10:35:40
Detected languages:
  • English - United States
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 10
Time date stamp: 23-Jan-2022 10:35:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x004FA000
0x00001000
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.80208
.rsrc
0x004FB000
0x0001A000
0x00019800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.21063
.Eh9PNx
0x00515000
0x0004B000
0x0004B000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.92002
.adata
0x00560000
0x00001000
0x00000000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST
101
7.2151
103424
UNKNOWN
Russian - Russia
RT_RCDATA

Imports

kernel32.dll
oleaut32.dll
user32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tradecheat.exe #REDLINE applaunch.exe

Process information

PID
CMD
Path
Indicators
Parent process
4016"C:\Users\admin\Desktop\tradecheat.exe" C:\Users\admin\Desktop\tradecheat.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
3216"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
tradecheat.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Total events
4 892
Read events
4 858
Write events
34
Delete events
0

Modification events

(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3216) AppLaunch.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AppLaunch_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3216AppLaunch.exeC:\Users\admin\AppData\Local\Temp\build.exeexecutable
MD5:A95D1E994821BD5D328A729BC188F143
SHA256:F835A9E8F8CA338CC8D4FE0B4E67FD1BB1727F815B79C3A694B60C1A86A8BB8E
3216AppLaunch.exeC:\Users\admin\AppData\Local\Temp\launch.exeexecutable
MD5:C2D7BF7A4785E8B2DDC22C01C533672C
SHA256:7322806DE0D6087D630168B501D56FBF34B00A9EA65C94A3AF51511AD3654220
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3216
AppLaunch.exe
GET
200
2.56.56.132:80
http://2.56.56.132/build.exe
unknown
executable
5.38 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3216
AppLaunch.exe
185.215.113.83:60722
Ebonyhorizon Telecomunicacoes S.A.
PT
malicious
3216
AppLaunch.exe
140.82.121.3:443
github.com
US
suspicious
3216
AppLaunch.exe
2.56.56.132:80
malicious
3216
AppLaunch.exe
185.199.111.133:443
raw.githubusercontent.com
GitHub, Inc.
NL
suspicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
shared

Threats

PID
Process
Class
Message
3216
AppLaunch.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 24
3216
AppLaunch.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3216
AppLaunch.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
3216
AppLaunch.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3216
AppLaunch.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3216
AppLaunch.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
29 ETPRO signatures available at the full report
No debug info