| File name: | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear |
| Full analysis: | https://app.any.run/tasks/9e6e23b6-88fb-486a-89a6-34a826aaba26 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | April 29, 2025, 02:38:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 05279D6B92F5E93ED1CA5EA6EC90672C |
| SHA1: | 356AB54BD87D1DDA67C34A4B26A4BEB65ACB44CA |
| SHA256: | 64C1AC17DAAADB7279A761EDBFC3F8842478D61E6F2C9094E3859B4C42DA02AF |
| SSDEEP: | 24576:FcwghQBv1lNyE+VSLDeZCY7yszuM1fhtLg/HDP7J2kGkqAj:FcwghQBv1lNyJVSLDeZCY7yszuM1fhtu |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:04:28 03:37:43+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 603136 |
| InitializedDataSize: | 102400 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x95272 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | Change Tracking |
| FileVersion: | 1.0.0.0 |
| InternalName: | PpFR.exe |
| LegalCopyright: | Copyright © Microsoft Corporation. All rights reserved. |
| LegalTrademarks: | - |
| OriginalFileName: | PpFR.exe |
| ProductName: | Change Tracking |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7400 | "C:\Users\admin\Desktop\2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe" | C:\Users\admin\Desktop\2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Change Tracking Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 7620 | "C:\Users\admin\Desktop\2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe" | C:\Users\admin\Desktop\2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Change Tracking Exit code: 0 Version: 1.0.0.0 Modules
RedLine(PID) Process(7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe C2 (1)31.56.36.73:44644 Botnetcheat Keys Xor Options ErrorMessage | |||||||||||||||
| 7636 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7960 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7620) 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FF9.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FE7.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FF8.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FC5.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp400A.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FD6.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp3FE6.tmp | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp40C2.tmp | binary | |
MD5:29A644B1F0D96166A05602FE27B3F4AD | SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp405F.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | C:\Users\admin\AppData\Local\Temp\tmp405E.tmp | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 304 | 52.149.20.212:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
— | — | GET | 200 | 52.149.20.212:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | unknown | — | — | — |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | POST | 200 | 31.56.36.73:44644 | http://31.56.36.73:44644/ | unknown | — | — | unknown |
7720 | SIHClient.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7720 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
7720 | SIHClient.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
7720 | SIHClient.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | POST | 200 | 31.56.36.73:44644 | http://31.56.36.73:44644/ | unknown | — | — | unknown |
7720 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7720 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
— | — | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | 31.56.36.73:44644 | — | Aria Shatel Company Ltd | IR | malicious |
7720 | SIHClient.exe | 4.245.163.56:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
google.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
api.ip.sb |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Malware Command and Control Activity Detected | ET MALWARE RedLine Stealer - CheckConnect Response |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | A Network Trojan was detected | AV TROJAN RedLine Stealer Config Download |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
7620 | 2025-04-29_05279d6b92f5e93ed1ca5ea6ec90672c_elex_hiddentear.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |