| URL: | https://bazaar.abuse.ch/download/ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844/ |
| Full analysis: | https://app.any.run/tasks/5f42a67e-1db7-4b23-a587-78b1aea226e6 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | May 09, 2024, 17:44:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 0D68AD8404B5DC184F6C716D9E427F31 |
| SHA1: | 6A25AF88F5EDAD598B7E8BF16E9E1D76C8B46CE1 |
| SHA256: | 0AD2B8B1A220973069FFE626757112A3E16549197A3D505805233D49BE2AA067 |
| SSDEEP: | 3:N8N0uDWB4uIDD5RlVMG9rdGlTRKn:23GADtXJGa |
MALICIOUS
Steals credentials from Web Browsers
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Steals credentials
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
REDLINE has been detected (YARA)
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Actions looks like stealing of personal data
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
SUSPICIOUS
Connects to unusual port
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Reads the Internet Settings
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Checks for external IP
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Device Retrieving External IP Address Detected
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Searches for installed software
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Reads browser cookies
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Potential Corporate Privacy Violation
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Reads settings of System Certificates
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
INFO
Application launched itself
- msedge.exe (PID: 3976)
Checks supported languages
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
- wmpnscfg.exe (PID: 2556)
Reads the computer name
- wmpnscfg.exe (PID: 2556)
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
The process uses the downloaded file
- WinRAR.exe (PID: 2696)
- msedge.exe (PID: 2616)
Manual execution by a user
- wmpnscfg.exe (PID: 2556)
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2696)
Reads the software policy settings
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 2696)
- msedge.exe (PID: 3976)
Reads Environment values
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Reads the machine GUID from the registry
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Create files in a temporary directory
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Reads product name
- ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
58
Monitored processes
23
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 444 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3672 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 728 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 764 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 956 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4184 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1044 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4248 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1072 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1532 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1244 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1944 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3268 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2028 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1664 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2036 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1344,i,15381451057780601501,6393464968532515272,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
Total events
16 729
Read events
16 611
Write events
106
Delete events
12
Modification events
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: 74D057419F762F00 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault |
| Operation: | delete value | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
Executable files
1
Suspicious files
136
Text files
45
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1041cd.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1041fc.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1042c7.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat | binary | |
MD5:A6EBC0D32A7B9304824D19DB63B4E37A | SHA256:E991057C2B1718A151C5FD06E1C153F57130D195454A1F94C8C4C20971697093 | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Version | text | |
MD5:61FE7896F9494DCDF53480A325F4FB85 | SHA256:ACFD3CD36E0DFCF1DCB67C7F31F2A5B9BA0815528A0C604D4330DFAA9E683E51 | |||
| 4000 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma~RF103809.TMP | binary | |
MD5:886E82F2CA62ECCCE64601B30592078A | SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
22
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2944 | ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe | POST | 200 | 195.10.205.91:1707 | http://195.10.205.91:1707/ | unknown | — | — | unknown |
2944 | ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe | POST | 200 | 195.10.205.91:1707 | http://195.10.205.91:1707/ | unknown | — | — | unknown |
2944 | ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe | GET | 200 | 2.18.188.140:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ab9d3f60123ab970 | unknown | — | — | unknown |
2944 | ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe | POST | 200 | 195.10.205.91:1707 | http://195.10.205.91:1707/ | unknown | — | — | unknown |
2944 | ab58fa9b11e94f2f09997258e17db4b3c3a2b33606679f00a22a89ee437ca844.exe | POST | 200 | 195.10.205.91:1707 | http://195.10.205.91:1707/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3976 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
2036 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2036 | msedge.exe | 151.101.194.49:443 | bazaar.abuse.ch | FASTLY | US | unknown |
2036 | msedge.exe | 13.107.21.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2036 | msedge.exe | 142.250.185.232:443 | www.googletagmanager.com | GOOGLE | US | unknown |
2036 | msedge.exe | 172.217.23.100:443 | www.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
bazaar.abuse.ch |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
www.google.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
www.bing.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com |
| whitelisted |
api.ip.sb |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
— | — | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
— | — | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
— | — | Successful Credential Theft Detected | STEALER [ANY.RUN] Clear Text Password Exfiltration Atempt |
— | — | Successful Credential Theft Detected | STEALER [ANY.RUN] Clear Text Login Exfiltration Atempt |
6 ETPRO signatures available at the full report