File name:

212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe

Full analysis: https://app.any.run/tasks/8942a1e5-2e86-4140-bf7f-b7cd9ca20501
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Malware Trends Tracker     >>>
Analysis date: April 24, 2024, 14:04:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
redline
meta
metastealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D41582BDE613BD63CAFFA80F482E692B

SHA1:

D1CCF0F0F4224E4DAA412C868729977CDDEC079E

SHA256:

212F5FB634003890F2B61ADE6D3BF474E16787E3F536F0484A2A23F55D562BF0

SSDEEP:

49152:YSNjPzTYfwRE9RJgwurLnXQevqcjHc1Yg:9NjPzTYIsKN5vqcjHk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe (PID: 2160)

    • Connects to the CnC server

      • RegAsm.exe (PID: 1992)

    • METASTEALER has been detected (SURICATA)

      • RegAsm.exe (PID: 1992)

    • REDLINE has been detected (SURICATA)

      • RegAsm.exe (PID: 1992)

    • REDLINE has been detected (YARA)

      • RegAsm.exe (PID: 1992)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 1992)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 1992)

  • SUSPICIOUS

    • Executes application which crashes

      • 212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe (PID: 2160)

    • Searches for installed software

      • RegAsm.exe (PID: 1992)

    • Connects to unusual port

      • RegAsm.exe (PID: 1992)

    • Non-standard symbols in registry

      • RegAsm.exe (PID: 1992)

  • INFO

    • Checks supported languages

      • RegAsm.exe (PID: 1992)
      • 212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe (PID: 2160)

    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 1992)

    • Creates files or folders in the user directory

      • RegAsm.exe (PID: 1992)
      • WerFault.exe (PID: 2036)

    • Reads the computer name

      • RegAsm.exe (PID: 1992)

    • Reads Environment values

      • RegAsm.exe (PID: 1992)

    • Checks proxy server information

      • WerFault.exe (PID: 2036)

    • Reads the software policy settings

      • WerFault.exe (PID: 2036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(1992) RegAsm.exe
C2 (1)5.42.65.96:28380
BotnetLogsDiller Cloud (TG: @logsdillabot)
Options
ErrorMessage
Keys
XorTulban
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:24 11:52:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 741376
InitializedDataSize: 502784
UninitializedDataSize: -
EntryPoint: 0x11cc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe regasm.exe no specs #REDLINE regasm.exe werfault.exe sppextcomobj.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1104C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1992"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(1992) RegAsm.exe
C2 (1)5.42.65.96:28380
BotnetLogsDiller Cloud (TG: @logsdillabot)
Options
ErrorMessage
Keys
XorTulban
2036C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2160 -s 400C:\Windows\SysWOW64\WerFault.exe
212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2160"C:\Users\admin\AppData\Local\Temp\212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe" C:\Users\admin\AppData\Local\Temp\212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226356
Modules
Images
c:\users\admin\appdata\local\temp\212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
4536"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msxml6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
5612"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
6 086
Read events
6 075
Write events
5
Delete events
6

Modification events

(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
C8070000620978525096DA01
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
47358B889C2063FB081AAAC26EF3623F96F2AE9B0A87BB053DE8DDFA5B8A01F7
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Local\Google\Chrome\User Data\lockfile
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
430CC97750C496DD624CC469E28B1118B732437A45F64EB6D30D9E80132C8905
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFilesHash
Value:
ృ矉쑐�䱢槄询᠑㊷穃뙎ී肞Ⱃ։
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFiles0000
Value:
C:\Users\admin\AppData\Local\Google\Chrome\User Data\lockfile
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
㕇袋ₜﭣᨈ슪㽢鮮蜊ֻ﫝詛
(PID) Process:(1992) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
߈
Executable files
0
Suspicious files
6
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
2036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_212f5fb634003890_88db3fed696c352e05ec894df27eb2fe35f7251_3398cc3a_3f1e23b7-3435-411e-8eaf-ba01b5f54273\Report.wer —
MD5:—
SHA256:—
2036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E18.tmp.dmpdmp
MD5:1F8011F89B9C7CD55F40CA6B22F3289B
SHA256:0CA9A8BBD0E683741C2D6528755ED70DCCEB02CF23A8835A60A3EB5BF0F7F803
2036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E78.tmp.xmlxml
MD5:A9F8B36124A15DD0DBBA7B4115CED4CA
SHA256:AAE1F5ED12F80D4AF8C16CD02F8454E95C7F901FB70983BFF77891189256006B
2036WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E58.tmp.WERInternalMetadata.xmlxml
MD5:2E237BB633217DCE896FB386F16F85A1
SHA256:BF9157094075ECA19C15C6E2F1C4D2D5722059D69D95AF2F6425E6527CC9012D
1992RegAsm.exeC:\Users\admin\AppData\Local\Temp\Tmp2ED4.tmpder
MD5:1420D30F964EAC2C85B2CCFE968EEBCE
SHA256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
1992RegAsm.exeC:\Users\admin\AppData\Local\Temp\Tmp2F04.tmpder
MD5:1420D30F964EAC2C85B2CCFE968EEBCE
SHA256:F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
1992RegAsm.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\76b53b3ec448f7ccdda2063b15d2bfc3_bb926e54-e3ca-40fd-ae90-2764341e7792dbf
MD5:BBC8DA7D36DF3F91C460984C2ABE8419
SHA256:0399CCF5E780949A63400736A46CCE7D1879903D0F45C6B7D194C960BA4DDDC2
2036WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe.2160.dmpbinary
MD5:070E1DEBD6F9AC5ACA809B91E9264F2C
SHA256:20F3D700DD796758BA543CBC76FDB5C0FEC9C1EBA212E63577BC08FCD6E9FF05
2036WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:23E663AD81C9272BE5114F8C7E4DD1D5
SHA256:E8A891BD9CC0448A7E7A33E03CF14A184069FEE7BF1E2EB853FE06E517562948
2036WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:874F93E3577ECCED745BED903229A281
SHA256:CCD42767AFB483EA3BFCCFD540AE52A4442ECA94D584255E8F6F807A86386937
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
32
DNS requests
11
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1036
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2036
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
2568
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5152
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4008
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1036
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1036
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
2568
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7112
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1992
RegAsm.exe
5.42.65.96:28380
—
CJSC Kolomna-Sviaz TV
RU
malicious
2568
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
2036
WerFault.exe
20.42.73.29:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.140
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
watson.events.data.microsoft.com
  • 20.42.73.29
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1992
RegAsm.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 1
1992
RegAsm.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
1992
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
1992
RegAsm.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
1992
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
—
—
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
—
—
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
—
—
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
—
—
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
—
—
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
212f5fb634003890f2b61ade6d3bf474e16787e3f536f0484a2a23f55d562bf0.exe