| File name: | Tool.exe |
| Full analysis: | https://app.any.run/tasks/eb1197b7-a2c8-465a-b9de-8ae36ac6a315 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | August 26, 2024, 15:39:04 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5: | D48F62048D05FE25AE38BEA06EC96E95 |
| SHA1: | D21C8D35EE8ABBA7D456542EBB1EA8D1F2AD6BFA |
| SHA256: | 3110A13A098E03CA4EBADF301969F5957D760FD85DF25B71401BEDCFCD91BF67 |
| SSDEEP: | 98304:QwzlOn6DnYYJ/Lv8zUfLhs1b3eu+OhnNc39t8:MI/QzJU |
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2010:11:30 04:32:56+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.35 |
| CodeSize: | 2539520 |
| InitializedDataSize: | 2059264 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x24eeac |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 30.0.2.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Unknown (0) |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | OBS |
| FileDescription: | OBS Studio |
| FileVersion: | 30.0.2 |
| InternalName: | obs |
| OriginalFileName: | obs |
| ProductName: | OBS Studio |
| ProductVersion: | 30.0.2 |
| Comments: | Free and open source software for video recording and live streaming |
| LegalCopyright: | (C) Lain Bailey |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1436 | C:\WINDOWS\system32\WerFault.exe -u -p 6784 -s 168 | C:\Windows\System32\WerFault.exe | Tool.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2520 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Tool.zip" C:\Users\admin\Desktop\Tool\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2824 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | Tool.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: AddInProcess.exe Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
RedLine(PID) Process(2824) AddInProcess32.exe C2 (1)51.195.206.227:38719 Botnettgsetupfudvero Options ErrorMessage Keys XorGarishness | |||||||||||||||
| 3164 | "C:\Users\admin\Desktop\Tool\Tool\Tool.exe" | C:\Users\admin\Desktop\Tool\Tool\Tool.exe | explorer.exe | ||||||||||||
User: admin Company: OBS Integrity Level: HIGH Description: OBS Studio Exit code: 1 Version: 30.0.2 Modules
| |||||||||||||||
| 4552 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5096 | "C:\Users\admin\Desktop\Tool.exe" | C:\Users\admin\Desktop\Tool.exe | — | explorer.exe | |||||||||||
User: admin Company: OBS Integrity Level: MEDIUM Description: OBS Studio Exit code: 3221225781 Version: 30.0.2 Modules
| |||||||||||||||
| 6376 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe | — | Tool.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: AddInProcess.exe Version: 4.8.9037.0 built by: NET481REL1 | |||||||||||||||
| 6784 | "C:\Users\admin\Desktop\Tool\Tool\Tool.exe" | C:\Users\admin\Desktop\Tool\Tool\Tool.exe | explorer.exe | ||||||||||||
User: admin Company: OBS Integrity Level: MEDIUM Description: OBS Studio Exit code: 3221226505 Version: 30.0.2 Modules
| |||||||||||||||
| 6916 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000503A8 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000503A8 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search |
| Operation: | write | Name: | TraySearchBoxVisible |
Value: 1 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search |
| Operation: | write | Name: | TraySearchBoxVisibleOnAnyMonitor |
Value: 1 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000603A8 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000603A8 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000703A8 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000703A8 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000803A8 |
| Operation: | write | Name: | VirtualDesktop |
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2 | |||
| (PID) Process: | (4552) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000803A8 |
| Operation: | delete key | Name: | (default) |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\avcodec-60.dll | — | |
MD5:— | SHA256:— | |||
| 4552 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 4552 | explorer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D104FE37139B161AD494CEA02ACEDE26 | binary | |
MD5:4D7EBCE95A63854608A80828559EBC40 | SHA256:8495A9E5639654CAB2917004FB7397C4472B05CB641F6D6B02AFB6A24871A039 | |||
| 4552 | explorer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | binary | |
MD5:D9F6C0A5C2562CC629C015F0B2C8868A | SHA256:C5EA99A90F6BCE9BE6EAC9A823ED96F63CD8420406DF5965DABD1377012A7A21 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\files\8.0.5\cs\ReachFramework.resources.dll | executable | |
MD5:88447037EBB5BBF71D95F8616904F2A5 | SHA256:246A12C9899E35D741FCD4E808D4C67AF6425D13513E7DA48CCC664BA2DBD0A9 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\files\8.0.5\cs\System.Windows.Forms.Primitives.resources.dll | executable | |
MD5:B64BF161DE9BD03A810D3C8FF559C57A | SHA256:2635006E8A4B7675DE45C6F5D32794B1E7D7F0804D9A435F5B17BCB93E7D2600 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\datachannel.dll | executable | |
MD5:1C7F360AA9F252FE7E3AF37AFB614BC5 | SHA256:26465AFB08FC2FFBFB87941332FB716F53ACA1517970C5F0B2153A1F40DAB5B4 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\files\8.0.5\cs\UIAutomationClient.resources.dll | executable | |
MD5:76D95A4D989D51CEA5EE6F6E6C8ACBE8 | SHA256:E5C2F654AED5187D8958279EB77989532BAA0968BCB223CB2930D7F4A030B8A5 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\files\8.0.5\cs\System.Windows.Controls.Ribbon.resources.dll | executable | |
MD5:7072D626904DD41A7F631371D60B035F | SHA256:53328E00F87DB6942BAFFCC25E64B4D1AF01CDAB59FB1D06E55D75788C868755 | |||
| 2520 | WinRAR.exe | C:\Users\admin\Desktop\Tool\Tool\avfilter-9.dll | executable | |
MD5:2F37E5CED7FC8482F659224EF38809CF | SHA256:BAEC3B2076C482707400A0061B23CC14271BAE715BED0C28C10CE73D771AC86C | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2028 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4552 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAbUGmZpIVP%2Fvl3v6HOt%2F2o%3D | unknown | — | — | whitelisted |
4552 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | whitelisted |
2584 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
2584 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4552 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 40.126.32.76:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2028 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2028 | svchost.exe | 40.126.32.76:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6192 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2584 | SIHClient.exe | 20.114.59.183:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2824 | AddInProcess32.exe | Potentially Bad Traffic | ET INFO Microsoft net.tcp Connection Initialization Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC - Id1Response |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2824 | AddInProcess32.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |