| File name: | uctdmt.7z |
| Full analysis: | https://app.any.run/tasks/85e0a869-3d7e-4206-86d2-9e3111ae2298 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | January 07, 2025, 15:37:16 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 8945E5BC2D9BE6ADD636CAB240CE85DD |
| SHA1: | 1E2608C7676E63CB8C8FF93A596BCA24DAA7FCFD |
| SHA256: | 8B1A72AE96EC1E3C4CAA8AE727DE9EEB23988FF5689BABC9C8E162A77AF7908A |
| SSDEEP: | 3072:rz1G+ULS8dsRPGnhGf/1xD8oN15fbue18ZOU9Od1k8:rz1G+ULS8dsReAj8a5WY9d1k8 |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 5780)
METASTEALER has been detected (SURICATA)
- spycleaner.exe (PID: 2212)
REDLINE has been detected (SURICATA)
- spycleaner.exe (PID: 2212)
Stealers network behavior
- spycleaner.exe (PID: 2212)
REDLINE has been detected (YARA)
- spycleaner.exe (PID: 2212)
Actions looks like stealing of personal data
- spycleaner.exe (PID: 2212)
Connects to the CnC server
- spycleaner.exe (PID: 2212)
SUSPICIOUS
Connects to unusual port
- spycleaner.exe (PID: 2212)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 5780)
Executing commands from a ".bat" file
- WinRAR.exe (PID: 5780)
Starts CMD.EXE for commands execution
- WinRAR.exe (PID: 5780)
INFO
Manual execution by a user
- spycleaner.exe (PID: 2212)
Checks supported languages
- spycleaner.exe (PID: 2212)
- MpCmdRun.exe (PID: 836)
Reads the computer name
- spycleaner.exe (PID: 2212)
Reads the machine GUID from the registry
- spycleaner.exe (PID: 2212)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 5780)
The process uses the downloaded file
- WinRAR.exe (PID: 5780)
Create files in a temporary directory
- MpCmdRun.exe (PID: 836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
RedLine
(PID) Process(2212) spycleaner.exe
C2 (1)185.81.68.147:1912
BotnetFJCX
Options
ErrorMessage
Keys
Xorioc
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2024:12:31 11:15:04+00:00 |
| ArchivedFileName: | spycleaner.exe |
Total processes
129
Monitored processes
8
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 836 | "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5780.6703" | C:\Program Files\Windows Defender\MpCmdRun.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Malware Protection Command Line Utility Exit code: 2 Version: 4.18.1909.6 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1140 | "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5780.11680" | C:\Program Files\Windows Defender\MpCmdRun.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Malware Protection Command Line Utility Exit code: 2 Version: 4.18.1909.6 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1804 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2212 | "C:\Users\admin\Desktop\spycleaner.exe" | C:\Users\admin\Desktop\spycleaner.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: XHP Exit code: 0 Version: 12.9.1.22 Modules
RedLine(PID) Process(2212) spycleaner.exe C2 (1)185.81.68.147:1912 BotnetFJCX Options ErrorMessage Keys Xorioc | |||||||||||||||
| 4052 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5780.6703\Rar$Scan11444.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5004 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5780.11680\Rar$Scan61229.bat" " | C:\Windows\System32\cmd.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5544 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5780 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\uctdmt.7z | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
Total events
3 520
Read events
3 510
Write events
10
Delete events
0
Modification events
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\uctdmt.7z | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (5780) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan |
| Operation: | write | Name: | DefScanner |
Value: Windows Defender | |||
Executable files
2
Suspicious files
0
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5780 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR5780.6703\Rar$Scan11444.bat | text | |
MD5:4C772109A41917C3F586D1F128BF840E | SHA256:5217EC40C2D97842C900F23A88DF482D753C0AEDD1F8B09A713FBA644381AF64 | |||
| 836 | MpCmdRun.exe | C:\Users\admin\AppData\Local\Temp\MpCmdRun.log | text | |
MD5:70FD520CEEF698105F6079C6D8AE2F93 | SHA256:9C6FAA51E8F33A4686A4C99B13FEA19C3221D9B28D5686E6754B3DF91ED8242E | |||
| 5780 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR5780.6703\uctdmt.7z\spycleaner.exe | executable | |
MD5:AE16DE1C6C9E15F640B4D4B04310C4BE | SHA256:3E1FD18A294C1E2903CCE49B29B42FE5669043C6F4A7F2B4BAE865B7CBC0169E | |||
| 5780 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR5780.11680\uctdmt.7z\spycleaner.exe | executable | |
MD5:AE16DE1C6C9E15F640B4D4B04310C4BE | SHA256:3E1FD18A294C1E2903CCE49B29B42FE5669043C6F4A7F2B4BAE865B7CBC0169E | |||
| 5780 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$VR5780.11680\Rar$Scan61229.bat | text | |
MD5:4C64D2FB41150C272F4F5345A9D6A62A | SHA256:F285076B69F3D1373FD4CA4D1F3A7ED49ABB62EE1AA56B704FD745102DB870EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
8
Threats
28
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
716 | svchost.exe | GET | 200 | 92.123.133.202:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 92.123.133.202:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4008 | RUXIMICS.exe | GET | 200 | 92.123.133.202:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.22.57.219:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
716 | svchost.exe | GET | 200 | 2.22.57.219:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4008 | RUXIMICS.exe | GET | 200 | 2.22.57.219:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
716 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4008 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.38.123.161:443 | www.bing.com | AKAMAI-AS | US | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
716 | svchost.exe | 92.123.133.202:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 92.123.133.202:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4008 | RUXIMICS.exe | 92.123.133.202:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
716 | svchost.exe | 2.22.57.219:80 | www.microsoft.com | AKAMAI-AS | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2212 | spycleaner.exe | Potentially Bad Traffic | ET INFO Microsoft net.tcp Connection Initialization Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC - Id1Response |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2212 | spycleaner.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |