| File name: | Desktop.rar |
| Full analysis: | https://app.any.run/tasks/e450baa3-bd15-4567-9df9-29c1e83fe663 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | December 30, 2024, 19:46:17 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | B458448A5BDE7B860E678E28D19FEDC4 |
| SHA1: | A4789AD59B5C88DBD0F6A8FA5055F29962EAFB9D |
| SHA256: | 8006C2295A01D37DE7604C86B18FDF52D9FB1F2DA06A34A6ED7D4A0CD773E4DD |
| SSDEEP: | 98304:4KXvawKJSXIsCBNV2pdNkt0GpTgRfoSRcQJF+mQaqf90k0vfHP+KXvamtsLTg0bD:yDf |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 2216)
Run PowerShell with an invisible window
- powershell.exe (PID: 6744)
METASTEALER has been detected (SURICATA)
- service.exe (PID: 7020)
Actions looks like stealing of personal data
- service.exe (PID: 7020)
REDLINE has been detected (SURICATA)
- service.exe (PID: 7020)
Connects to the CnC server
- service.exe (PID: 7020)
Steals credentials from Web Browsers
- service.exe (PID: 7020)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 2216)
- voii.exe (PID: 6620)
Starts POWERSHELL.EXE for commands execution
- voii.exe (PID: 6620)
Base64-obfuscated command line is found
- voii.exe (PID: 6620)
BASE64 encoded PowerShell command has been detected
- voii.exe (PID: 6620)
Executable content was dropped or overwritten
- voii.exe (PID: 6620)
Connects to unusual port
- service.exe (PID: 7020)
INFO
The process uses the downloaded file
- WinRAR.exe (PID: 2216)
- voii.exe (PID: 6620)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2216)
Checks supported languages
- voii.exe (PID: 6620)
- service.exe (PID: 7020)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 6744)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 6744)
Drops encrypted VBS script (Microsoft Script Encoder)
- service.exe (PID: 7020)
Reads the computer name
- voii.exe (PID: 6620)
Creates files or folders in the user directory
- voii.exe (PID: 6620)
Reads the machine GUID from the registry
- service.exe (PID: 7020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 1259727 |
| UncompressedSize: | 3084288 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | bro.exe |
Total processes
131
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2216 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Desktop.rar | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6568 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\voii.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\voii.exe | — | WinRAR.exe | |||||||||||
User: admin Company: fg Integrity Level: MEDIUM Description: fg Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6620 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\voii.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\voii.exe | WinRAR.exe | ||||||||||||
User: admin Company: fg Integrity Level: HIGH Description: fg Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6744 | "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAYQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABsAGgAcABnAHAAYQBxADMAdQBxAHgAbwBlAGQAdABvAGEAcgBiAHUAcwAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | voii.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6752 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7020 | "C:\Users\admin\AppData\Roaming\lhpgpaq3uqxoedtoarbus\service.exe" | C:\Users\admin\AppData\Roaming\lhpgpaq3uqxoedtoarbus\service.exe | voii.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: XHP Exit code: 0 Version: 12.9.1.22 Modules
| |||||||||||||||
Total events
9 366
Read events
9 358
Write events
8
Delete events
0
Modification events
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Desktop.rar | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2216) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
3
Suspicious files
1
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2216 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\bro.exe | executable | |
MD5:0FACAB8D1C55A7747BA2527BB2576701 | SHA256:2F516C9D9EAC5BCC3793B847E4733F7CEB3D25EA35A210B18A871F213846C5AB | |||
| 2216 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2216.29555\voii.exe | executable | |
MD5:5B3210DEA911DBC9E9AFDA584F67CCD0 | SHA256:2DC944DBB03D95B13B7E2D71E9B6F87C0B461BE8334192CDB6B66DE507419E98 | |||
| 6620 | voii.exe | C:\Users\admin\AppData\Roaming\lhpgpaq3uqxoedtoarbus\service.exe | executable | |
MD5:1073E948E6F7BD2C4DEADF6B563C3450 | SHA256:98DF31C217AF51F6F059D48942EE2F59F0F03BDA76F3A40D7B72048344A608F8 | |||
| 6744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nwilou1d.lgk.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2r2f1rqq.m5t.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6744 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:DF080292F696CC93A3FFDCE3EF4EA908 | SHA256:3E219EF781B30CC039D38FC8D5CB60703DDB7BFA0FE12034FB5ACFD77BE6EB4F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
16
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
4824 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6192 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
4824 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5892 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4140 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | SearchApp.exe | 2.23.209.179:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
5064 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1176 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| unknown |
fd.api.iris.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7020 | service.exe | Potentially Bad Traffic | ET INFO Microsoft net.tcp Connection Initialization Activity |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
7020 | service.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC - Id1Response |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
7020 | service.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |