File name:

RedEngine Cracked V5.rar

Full analysis: https://app.any.run/tasks/2944b9b8-b5d8-44e8-ba4d-86adafb3d93e
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: May 24, 2021, 17:55:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
nanocore
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

78696F8710F4DD376ED064B18D1CBD75

SHA1:

6908D09F84321FA025F60B17BB3698DA3D406BD7

SHA256:

BBC11A7118F6A45FF0C833089BA5BB8FCCE1A9289C6E165328CDDFBBA832247D

SSDEEP:

98304:45tBSlBnnluRI7cglA+3lq8KTTVt/hznuWcXEFlgnpaZ:4TGluO7ccA+3lqZ/r/pRcUFSpaZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • RedEngine.exe (PID: 3404)
      • svchost.exe (PID: 272)
      • Update RedEngine.exe (PID: 1500)

    • Changes the autorun value in the registry

      • RedEngine.exe (PID: 2692)
      • RedEngine.exe (PID: 1872)
      • svchost.exe (PID: 272)

    • Application was dropped or rewritten from another process

      • RedEngine.exe (PID: 2692)
      • resourcefilehaha.exe (PID: 1024)
      • resourcefilehaha2.exe (PID: 3960)
      • RedEngine.exe (PID: 1872)
      • RedEngine.exe (PID: 2680)
      • resourcefilehaha.exe (PID: 3552)
      • resourcefilehaha2.exe (PID: 2648)
      • svchost.exe (PID: 272)

    • Actions looks like stealing of personal data

      • RedEngine.exe (PID: 2692)
      • resourcefilehaha.exe (PID: 1024)
      • RedEngine.exe (PID: 1872)
      • resourcefilehaha.exe (PID: 3552)

    • Steals credentials from Web Browsers

      • resourcefilehaha.exe (PID: 1024)
      • resourcefilehaha.exe (PID: 3552)

    • Changes settings of System certificates

      • RedEngine.exe (PID: 1872)

    • NANOCORE was detected

      • svchost.exe (PID: 272)

    • Connects to CnC server

      • svchost.exe (PID: 272)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RedEngine.exe (PID: 2692)
      • RedEngine.exe (PID: 3404)
      • RedEngine.exe (PID: 1872)
      • Update RedEngine.exe (PID: 1500)
      • svchost.exe (PID: 272)

    • Drops a file with too old compile date

      • RedEngine.exe (PID: 3404)
      • RedEngine.exe (PID: 2692)
      • RedEngine.exe (PID: 1872)

    • Drops a file that was compiled in debug mode

      • RedEngine.exe (PID: 2692)
      • RedEngine.exe (PID: 1872)

    • Reads the cookies of Google Chrome

      • resourcefilehaha2.exe (PID: 3960)
      • resourcefilehaha2.exe (PID: 2648)

    • Adds / modifies Windows certificates

      • RedEngine.exe (PID: 1872)

    • Creates executable files which already exist in Windows

      • Update RedEngine.exe (PID: 1500)

    • Creates files in the user directory

      • svchost.exe (PID: 272)

  • INFO

    • Manual execution by user

      • RedEngine.exe (PID: 3404)
      • Update RedEngine.exe (PID: 1500)

    • Reads settings of System Certificates

      • RedEngine.exe (PID: 1872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
11
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs redengine.exe redengine.exe resourcefilehaha.exe resourcefilehaha2.exe no specs redengine.exe no specs redengine.exe resourcefilehaha.exe resourcefilehaha2.exe no specs update redengine.exe #NANOCORE svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\RarSFX1\svchost.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\svchost.exe
Update RedEngine.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
344"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RedEngine Cracked V5.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1024"C:\Users\admin\AppData\Local\Temp\resourcefilehaha.exe" /C /stext C:\Users\admin\AppData\Local\Temp\credentialslmao.txtC:\Users\admin\AppData\Local\Temp\resourcefilehaha.exe
RedEngine.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Web Browser Password Viewer
Exit code:
0
Version:
2.06
Modules
Images
c:\users\admin\appdata\local\temp\resourcefilehaha.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1500"C:\Users\admin\Desktop\RedEngine Cracked\Update RedEngine.exe" C:\Users\admin\Desktop\RedEngine Cracked\Update RedEngine.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\redengine cracked\update redengine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1872"C:\Users\admin\AppData\Local\Temp\RedEngine.exe" C:\Users\admin\AppData\Local\Temp\RedEngine.exe
RedEngine.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
3762504530
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\redengine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2648"C:\Users\admin\AppData\Local\Temp\resourcefilehaha2.exe" /C /stext C:\Users\admin\AppData\Local\Temp\cookieslmao.txtC:\Users\admin\AppData\Local\Temp\resourcefilehaha2.exe—RedEngine.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\resourcefilehaha2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
2680"C:\Users\admin\AppData\Local\Temp\RedEngine.exe" C:\Users\admin\AppData\Local\Temp\RedEngine.exe—RedEngine.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\redengine.exe
c:\systemroot\system32\ntdll.dll
2692"C:\Users\admin\AppData\Local\Temp\RarSFX0\RedEngine.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\RedEngine.exe
RedEngine.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\redengine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3404"C:\Users\admin\Desktop\RedEngine Cracked\RedEngine.exe" C:\Users\admin\Desktop\RedEngine Cracked\RedEngine.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\redengine cracked\redengine.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3552"C:\Users\admin\AppData\Local\Temp\resourcefilehaha.exe" /C /stext C:\Users\admin\AppData\Local\Temp\credentialslmao.txtC:\Users\admin\AppData\Local\Temp\resourcefilehaha.exe
RedEngine.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
Web Browser Password Viewer
Exit code:
0
Version:
2.06
Modules
Images
c:\users\admin\appdata\local\temp\resourcefilehaha.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 076
Read events
2 003
Write events
73
Delete events
0

Modification events

(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(344) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(344) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RedEngine Cracked V5.rar
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(344) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3404) RedEngine.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
9
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa344.30012\RedEngine Cracked\Fivem.CFX.dll —
MD5:—
SHA256:—
344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa344.30012\RedEngine Cracked\InjectAPI.dll —
MD5:—
SHA256:—
344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa344.30012\RedEngine Cracked\WebSocket.2.1.version.dll —
MD5:—
SHA256:—
344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa344.30012\RedEngine Cracked\Update RedEngine.exe —
MD5:—
SHA256:—
344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa344.30012\RedEngine Cracked\RedEngine.exe —
MD5:—
SHA256:—
2692RedEngine.exeC:\Users\admin\AppData\Local\Temp\screen.jpg —
MD5:—
SHA256:—
1024resourcefilehaha.exeC:\Users\admin\AppData\Local\Temp\credentialslmao.txt —
MD5:—
SHA256:—
2692RedEngine.exeC:\Users\admin\AppData\Local\Temp\browsercredentials.txt —
MD5:—
SHA256:—
3960resourcefilehaha2.exeC:\Users\admin\AppData\Local\Temp\cookieslmao.txt —
MD5:—
SHA256:—
2692RedEngine.exeC:\Users\admin\AppData\Local\Temp\cookiescredentials.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
35
DNS requests
17
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1872
RedEngine.exe
GET
200
66.171.248.178:80
http://ipv4bot.whatismyipaddress.com/
US
text
13 b
shared
2692
RedEngine.exe
GET
200
66.171.248.178:80
http://ipv4bot.whatismyipaddress.com/
US
text
13 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
272
svchost.exe
18.198.77.177:17746
4.tcp.eu.ngrok.io
Massachusetts Institute of Technology
US
malicious
272
svchost.exe
3.121.139.82:17746
4.tcp.eu.ngrok.io
—
US
malicious
1872
RedEngine.exe
199.188.200.202:443
www.stelybuilder.wtf
Namecheap, Inc.
US
suspicious
272
svchost.exe
8.8.8.8:53
—
Google Inc.
US
malicious
—
—
192.168.100.24:137
—
—
—
malicious
272
svchost.exe
3.127.253.86:17746
4.tcp.eu.ngrok.io
—
US
malicious
272
svchost.exe
35.158.159.254:17746
4.tcp.eu.ngrok.io
Amazon.com, Inc.
DE
malicious
2692
RedEngine.exe
66.171.248.178:80
ipv4bot.whatismyipaddress.com
Alchemy Communications, Inc.
US
malicious
2692
RedEngine.exe
199.188.200.202:443
www.stelybuilder.wtf
Namecheap, Inc.
US
suspicious
1872
RedEngine.exe
66.171.248.178:80
ipv4bot.whatismyipaddress.com
Alchemy Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
ipv4bot.whatismyipaddress.com
  • 66.171.248.178
shared
www.stelybuilder.wtf
  • 199.188.200.202
unknown
4.tcp.eu.ngrok.io
  • 3.121.139.82
  • 18.198.77.177
  • 3.127.253.86
  • 35.158.159.254
malicious

Threats

PID
Process
Class
Message
1040
svchost.exe
Potential Corporate Privacy Violation
AV POLICY Observed DNS Query for Suspicious TLD (.wtf)
272
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
272
svchost.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
272
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
272
svchost.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
272
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
272
svchost.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
272
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
272
svchost.exe
A Network Trojan was detected
ET TROJAN Possible NanoCore C2 60B
272
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RedEngine Cracked V5.rar