| File name: | Crunchyroll Checker by xRisky.exe |
| Full analysis: | https://app.any.run/tasks/65f121fc-85b5-416c-98a5-5f46bb7c0de4 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | August 05, 2024, 17:38:08 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | C1569F6F8A566286BE9C1462A45439F0 |
| SHA1: | 495666664562A811021E044228917B25A8A9C0B6 |
| SHA256: | 34C5044AE9B4EAEA508F2444A2BDC861B5BAEF9839950E7F0AC8F478119B7923 |
| SSDEEP: | 98304:Xg6zKt+WBvkiwGESO2yXSHoFGkfyIuXheqJQ6bwb3olh30A7cbUSkcCeA1YIhDEv:0ydjfP |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:08:05 08:25:40+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 2189824 |
| InitializedDataSize: | 116224 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x21889e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Crunchyroll Checker by xRisky |
| CompanyName: | Crunchyroll Checker by xRisky |
| FileDescription: | Crunchyroll Checker by xRisky |
| FileVersion: | 1.0.0.0 |
| InternalName: | Output.exe |
| LegalCopyright: | Copyright © 2019 |
| LegalTrademarks: | Crunchyroll Checker by xRisky |
| OriginalFileName: | Output.exe |
| ProductName: | Crunchyroll Checker by xRisky |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 188 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 188 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 236 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 300 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 304 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 320 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 320 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 320 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| 376 | "C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe" | C:\Users\admin\AppData\Local\Temp\Crunchyroll Checker by xRisky.exe | — | Crunchyroll Checker by xRisky.exe | |||||||||||
User: admin Company: Crunchyroll Checker by xRisky Integrity Level: MEDIUM Description: Crunchyroll Checker by xRisky Exit code: 0 Version: 1.0.0.0 | |||||||||||||||
| (PID) Process: | (6364) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6364) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6364) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6364) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6440) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6440) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6440) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6440) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6520) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6520) Crunchyroll Checker by xRisky.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6364 | Crunchyroll Checker by xRisky.exe | C:\Users\admin\AppData\Local\Temp\MetroSuite 2.0.dll | executable | |
MD5:0D30A398CEC0FF006B6EA2B52D11E744 | SHA256:8604BF2A1FE2E94DC1EA1FBD0CF54E77303493B93994DF48479DC683580AA654 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD1F2.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD214.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD202.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 2928 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:9D8F8E87A49355E07DD197C90D0A09F4 | SHA256:D058A5628D97F2FED5F198ADFF2F1EBDE4F91BBD5213B593FEF0D4603B1A7000 | |||
| 2928 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ohrtnfgi.j55.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD215.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD203.tmp | sqlite | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD238.tmp | sqlite | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 6920 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpD217.tmp | sqlite | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5092 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5092 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6740 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6920 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | unknown | — | — | unknown |
6400 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6920 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | unknown | — | — | unknown |
6920 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | unknown | — | — | unknown |
6920 | RegAsm.exe | POST | 200 | 51.83.170.23:16128 | http://51.83.170.23:16128/ | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4576 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2872 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4576 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5336 | SearchApp.exe | 95.100.146.10:443 | www.bing.com | Akamai International B.V. | CZ | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5092 | svchost.exe | 40.126.32.133:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6920 | RegAsm.exe | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
6920 | RegAsm.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
6920 | RegAsm.exe | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
6920 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |