URL:

https://mega.nz/folder/KQc1DCzS#UHk2Ot0UxHV-hv-bAh7HRA

Full analysis: https://app.any.run/tasks/70e7f3be-a831-4abf-99f4-2688c222a1a1
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 18, 2021, 20:01:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
redline
trojan
stealer
Indicators:
MD5:

FC398BDC9380B002137ACD391E3CA630

SHA1:

3C99FA836DA32191214CF436D7047845C3214C59

SHA256:

D0E28697E40FAB43702C518F35AB0C5BA903BD640CF4D54FDAD1DC2AC0EB9903

SSDEEP:

3:N8X/iuyKgfhY4kE5k:26Nfa4m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 544)
    • Stealing of credential data

      • AddInProcess32.exe (PID: 544)
    • Application was dropped or rewritten from another process

      • Injector.exe (PID: 1428)
    • Steals credentials from Web Browsers

      • AddInProcess32.exe (PID: 544)
    • Changes settings of System certificates

      • Injector.exe (PID: 1428)
      • AddInProcess32.exe (PID: 544)
    • REDLINE was detected

      • AddInProcess32.exe (PID: 544)
  • SUSPICIOUS

    • Reads Environment values

      • AddInProcess32.exe (PID: 544)
    • Reads the cookies of Google Chrome

      • AddInProcess32.exe (PID: 544)
    • Drops a file with too old compile date

      • WinRAR.exe (PID: 932)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 932)
    • Reads the cookies of Mozilla Firefox

      • AddInProcess32.exe (PID: 544)
    • Adds / modifies Windows certificates

      • Injector.exe (PID: 1428)
      • AddInProcess32.exe (PID: 544)
    • Searches for installed software

      • AddInProcess32.exe (PID: 544)
  • INFO

    • Manual execution by user

      • Injector.exe (PID: 1428)
      • WinRAR.exe (PID: 932)
      • WinRAR.exe (PID: 3924)
      • explorer.exe (PID: 3916)
    • Application launched itself

      • chrome.exe (PID: 2000)
    • Reads the hosts file

      • chrome.exe (PID: 2400)
      • chrome.exe (PID: 2000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs winrar.exe no specs winrar.exe injector.exe #REDLINE addinprocess32.exe

Process information

PID
CMD
Path
Indicators
Parent process
544C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Injector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AddInProcess.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
932"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Ice Hack.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,14693849978204387556,525616985742477083,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4087940503685692709 --mojo-platform-channel-handle=3984 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,14693849978204387556,525616985742477083,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3164485772985425302 --mojo-platform-channel-handle=1072 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1368"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,14693849978204387556,525616985742477083,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1185402126720936535 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1428"C:\Users\admin\Desktop\Injector.exe" C:\Users\admin\Desktop\Injector.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Humanist Caller
Exit code:
0
Version:
5.14.22.1
Modules
Images
c:\users\admin\desktop\injector.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1828"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1056,14693849978204387556,525616985742477083,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15214816612388987075 --mojo-platform-channel-handle=3688 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2000"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://mega.nz/folder/KQc1DCzS#UHk2Ot0UxHV-hv-bAh7HRA"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2284"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2384 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2400"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1056,14693849978204387556,525616985742477083,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=10366283878588698235 --mojo-platform-channel-handle=1544 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 771
Read events
1 648
Write events
120
Delete events
3

Modification events

(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2000) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2000) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2000-13260571320982375
Value:
259
Executable files
1
Suspicious files
33
Text files
100
Unknown types
9

Dropped files

PID
Process
Filename
Type
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6053B1B9-7D0.pma
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\23b3839c-0675-4cb8-9a75-d48cb95716d2.tmp
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:1A89A1BEBE6C843C4FF582E7ED33CA1F
SHA256:65099CA087B66AA8CA420AB121DAAD713E1DB5A61C5A574D9B1C0DF24F012520
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENTtext
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old
MD5:
SHA256:
2000chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF132fbe.TMP
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
28
DNS requests
13
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
544
AddInProcess32.exe
POST
200
5.101.66.180:80
http://dylarache.site/
RU
text
367 b
malicious
544
AddInProcess32.exe
POST
200
5.101.66.180:80
http://dylarache.site/
RU
text
129 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
chrome.exe
89.44.169.135:443
mega.nz
Datacenter Luxembourg S.A.
LU
suspicious
2400
chrome.exe
142.250.186.109:443
accounts.google.com
Google Inc.
US
whitelisted
2400
chrome.exe
216.58.212.170:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2400
chrome.exe
142.250.185.110:443
clients1.google.com
Google Inc.
US
whitelisted
2400
chrome.exe
66.203.124.37:443
eu.static.mega.co.nz
RealNetworks, Inc.
US
suspicious
2400
chrome.exe
142.250.186.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2400
chrome.exe
89.44.168.218:443
gfs270n077.userstorage.mega.co.nz
Datacenter Luxembourg S.A.
LU
suspicious
2400
chrome.exe
216.58.212.174:443
safebrowsing.google.com
Google Inc.
US
whitelisted
2400
chrome.exe
66.203.125.14:443
g.api.mega.co.nz
RealNetworks, Inc.
US
unknown
1428
Injector.exe
81.177.140.11:443
71yc.hizman.ru
JSC RTComm.RU
RU
malicious

DNS requests

Domain
IP
Reputation
mega.nz
  • 89.44.169.135
whitelisted
accounts.google.com
  • 142.250.186.109
shared
safebrowsing.googleapis.com
  • 216.58.212.170
whitelisted
clients1.google.com
  • 142.250.185.110
whitelisted
eu.static.mega.co.nz
  • 66.203.124.37
  • 89.44.169.134
  • 66.203.127.11
  • 89.44.169.132
  • 66.203.127.13
shared
g.api.mega.co.nz
  • 66.203.125.14
  • 66.203.125.11
  • 66.203.125.15
  • 66.203.125.13
  • 66.203.125.12
shared
gfs270n077.userstorage.mega.co.nz
  • 89.44.168.218
suspicious
ssl.gstatic.com
  • 142.250.186.163
whitelisted
sb-ssl.google.com
  • 142.250.185.110
whitelisted
safebrowsing.google.com
  • 216.58.212.174
whitelisted

Threats

PID
Process
Class
Message
544
AddInProcess32.exe
A Network Trojan was detected
SPYWARE [PTsecurity] RedLine
544
AddInProcess32.exe
A Network Trojan was detected
SPYWARE [PTsecurity] RedLine
3 ETPRO signatures available at the full report
No debug info