File name:

RFQ_TFS-1508-ALNASRENGINEERING.exe

Full analysis: https://app.any.run/tasks/42705b47-47bd-45df-a7af-9a9503e6896d
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Analysis date: November 18, 2024, 16:41:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
redline
lefthook
metastealer
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

51E2A4CF52A06BFF7B50826173D6A0AD

SHA1:

D5450D3259DF08A3D0C0A0B91B586E8532FAB2E0

SHA256:

7087A8601EECC0AD79246FE0EB6CB2E9562B510495281DFE4C6DF888B2B22B43

SSDEEP:

49152:3aHKOMnjkkA+PU9Nq5cuL7xrlPe+6wfaRv8X/:3aHKOhkA+OIqudVetRv8/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • REDLINE has been detected (SURICATA)

      • InstallUtil.exe (PID: 5084)
    • REDLINE has been detected (YARA)

      • InstallUtil.exe (PID: 5084)
    • METASTEALER has been detected (SURICATA)

      • InstallUtil.exe (PID: 5084)
    • Stealers network behavior

      • InstallUtil.exe (PID: 5084)
    • LEFTHOOK has been detected (SURICATA)

      • InstallUtil.exe (PID: 5084)
  • SUSPICIOUS

    • Script adds exclusion path to Windows Defender

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Reads security settings of Internet Explorer

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Reads the date of Windows installation

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Starts POWERSHELL.EXE for commands execution

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Executes application which crashes

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Checks for external IP

      • svchost.exe (PID: 2172)
      • InstallUtil.exe (PID: 5084)
    • Potential Corporate Privacy Violation

      • InstallUtil.exe (PID: 5084)
    • Connects to unusual port

      • InstallUtil.exe (PID: 5084)
    • Contacting a server suspected of hosting an CnC

      • InstallUtil.exe (PID: 5084)
  • INFO

    • Reads the computer name

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Checks supported languages

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Reads the machine GUID from the registry

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • Process checks computer location settings

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
    • The process uses the downloaded file

      • RFQ_TFS-1508-ALNASRENGINEERING.exe (PID: 5172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(5084) InstallUtil.exe
C2 (1)193.70.111.186:13484
Botnethyce
Keys
Xor
Options
ErrorMessage
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2047:04:17 05:40:32+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 9816
InitializedDataSize: 1446
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Hurensohn
FileVersion: 1.0.0.0
InternalName: Hurensohn.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: Hurensohn.exe
ProductName: Hurensohn
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rfq_tfs-1508-alnasrengineering.exe powershell.exe no specs conhost.exe no specs #REDLINE installutil.exe installutil.exe no specs conhost.exe no specs werfault.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3848"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeRFQ_TFS-1508-ALNASRENGINEERING.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
4164C:\WINDOWS\system32\WerFault.exe -u -p 5172 -s 1340C:\Windows\System32\WerFault.exe
RFQ_TFS-1508-ALNASRENGINEERING.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
5084"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
RFQ_TFS-1508-ALNASRENGINEERING.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
RedLine
(PID) Process(5084) InstallUtil.exe
C2 (1)193.70.111.186:13484
Botnethyce
Keys
Xor
Options
ErrorMessage
5172"C:\Users\admin\Desktop\RFQ_TFS-1508-ALNASRENGINEERING.exe" C:\Users\admin\Desktop\RFQ_TFS-1508-ALNASRENGINEERING.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Hurensohn
Exit code:
3221226356
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\rfq_tfs-1508-alnasrengineering.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeInstallUtil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6720"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\Desktop\RFQ_TFS-1508-ALNASRENGINEERING.exe" -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRFQ_TFS-1508-ALNASRENGINEERING.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 531
Read events
17 516
Write events
15
Delete events
0

Modification events

(PID) Process:(5172) RFQ_TFS-1508-ALNASRENGINEERING.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Operation:writeName:Enabled
Value:
0
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
0
Suspicious files
40
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4164WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RFQ_TFS-1508-ALN_b0102133ee7a9716474349e87f5401f4ed2db5a_b67733ac_785cda9d-81f8-447e-b44b-4f9daa6d50b6\Report.wer
MD5:
SHA256:
4164WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\RFQ_TFS-1508-ALNASRENGINEERING.exe.5172.dmp
MD5:
SHA256:
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA29.tmpsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA4B.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6720powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_txsahhh2.sot.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA3A.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA18.tmpsqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
4164WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD0C7.tmp.WERInternalMetadata.xmlxml
MD5:9D66BE24835A6EE4D58C7486F55DCA70
SHA256:2A3F3FFFA9A6E1EF36CEF62F959A22EC9DD6392FA47ACB4B41E166B5D15745A5
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA4C.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5084InstallUtil.exeC:\Users\admin\AppData\Local\Temp\tmpFA39.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
24
DNS requests
8
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1764
RUXIMICS.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6944
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5084
InstallUtil.exe
POST
200
193.70.111.186:13484
http://193.70.111.186:13484/
unknown
unknown
6944
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5084
InstallUtil.exe
POST
200
193.70.111.186:13484
http://193.70.111.186:13484/
unknown
unknown
5084
InstallUtil.exe
POST
200
193.70.111.186:13484
http://193.70.111.186:13484/
unknown
unknown
1764
RUXIMICS.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5084
InstallUtil.exe
POST
200
193.70.111.186:13484
http://193.70.111.186:13484/
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1764
RUXIMICS.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
6944
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1764
RUXIMICS.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
api.ip.sb
  • 172.67.75.172
  • 104.26.13.31
  • 104.26.12.31
whitelisted
self.events.data.microsoft.com
  • 104.46.162.226
whitelisted

Threats

PID
Process
Class
Message
5084
InstallUtil.exe
Malware Command and Control Activity Detected
ET MALWARE RedLine Stealer - CheckConnect Response
5084
InstallUtil.exe
A Network Trojan was detected
AV TROJAN RedLine Stealer Config Download
5084
InstallUtil.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound
5084
InstallUtil.exe
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
6 ETPRO signatures available at the full report
No debug info