| File name: | 41ece00a8f6eb23dc9b2c4e839264896.exe |
| Full analysis: | https://app.any.run/tasks/9d088beb-bda1-43db-80d8-bb25185ccbc7 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | March 24, 2025, 17:56:49 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 41ECE00A8F6EB23DC9B2C4E839264896 |
| SHA1: | 019AF05AEDB454D15F193713FEF31524CFAB6E6D |
| SHA256: | 2D8A45F0DE92AEB5FC5495C2DF0072A00E4D2215B0B2C1CCFD1580D752E32F27 |
| SSDEEP: | 24576:QgvpwD3vxFWrP/eAM9v8SRbNkw4MiiW3jMwpGIQf20X:QgvpwD3vxFWrP/eAM9v8SRbNkw5iiQjI |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (70.7) |
|---|---|---|
| .scr | | | Windows screen saver (12.6) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.3) |
| .exe | | | Win32 Executable (generic) (4.3) |
| .exe | | | Win16/32 Executable Delphi generic (2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2088:05:17 15:53:25+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 595968 |
| InitializedDataSize: | 7680 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x936a6 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | Report Manager |
| FileVersion: | 1.0.0.0 |
| InternalName: | bAXl.exe |
| LegalCopyright: | Copyright © 2021 |
| LegalTrademarks: | - |
| OriginalFileName: | bAXl.exe |
| ProductName: | Report Manager |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4608 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5164 | "C:\Users\admin\Desktop\41ece00a8f6eb23dc9b2c4e839264896.exe" | C:\Users\admin\Desktop\41ece00a8f6eb23dc9b2c4e839264896.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Report Manager Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6388 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 41ece00a8f6eb23dc9b2c4e839264896.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6540 | "C:\Users\admin\Desktop\41ece00a8f6eb23dc9b2c4e839264896.exe" | C:\Users\admin\Desktop\41ece00a8f6eb23dc9b2c4e839264896.exe | 41ece00a8f6eb23dc9b2c4e839264896.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Report Manager Exit code: 0 Version: 1.0.0.0 Modules
RedLine(PID) Process(6540) 41ece00a8f6eb23dc9b2c4e839264896.exe C2 (1)185.222.57.71:55615 Botnetcheat Keys Xor Options ErrorMessage | |||||||||||||||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6540) 41ece00a8f6eb23dc9b2c4e839264896.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\41ece00a8f6eb23dc9b2c4e839264896_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22BB.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22AA.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp2298.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22BC.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22F0.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22A9.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22DE.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp2302.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22F1.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | C:\Users\admin\AppData\Local\Temp\tmp22EF.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2104 | svchost.exe | GET | 200 | 23.48.23.162:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | POST | 200 | 185.222.57.71:55615 | http://185.222.57.71:55615/ | unknown | — | — | unknown |
— | — | GET | 304 | 4.245.163.56:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
— | — | POST | 200 | 20.190.160.67:443 | https://login.live.com/RST2.srf | unknown | xml | 10.3 Kb | whitelisted |
— | — | POST | 400 | 20.190.160.5:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
— | — | POST | 200 | 20.190.160.67:443 | https://login.live.com/RST2.srf | unknown | xml | 1.35 Kb | whitelisted |
— | — | POST | 400 | 20.190.160.66:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
5964 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
5964 | SIHClient.exe | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
— | — | POST | 400 | 20.190.160.67:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
2104 | svchost.exe | 23.48.23.162:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6544 | svchost.exe | 40.126.31.1:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5640 | backgroundTaskHost.exe | 20.74.47.205:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | 185.222.57.71:55615 | — | RootLayer Web Services Ltd. | NL | malicious |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | 172.67.75.172:443 | api.ip.sb | CLOUDFLARENET | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
api.ip.sb |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
6540 | 41ece00a8f6eb23dc9b2c4e839264896.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |