File name:

DAZN Tool Premium.zip

Full analysis: https://app.any.run/tasks/75ea7f34-f25b-4cd5-b026-4bb55a9bc439
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Analysis date: September 02, 2024, 20:31:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
redline
metastealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

9E37F8A2C6906DC050EBDE931417D5AD

SHA1:

285C8A849DEAE7A974414B3B6DA5168E47C0C2F2

SHA256:

F63641E48F64C50BBEF5A63110736F6DB4F3DC6B14284762AFC56A36EADBBF5F

SSDEEP:

98304:Pgk7FbmndoeObKB2jbPASkRFY/7wTI4Ykwlqrwc34GljnhU5AzBccuW+k+ykmUwD:b+QvlsOBHG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Stealers network behavior

      • RegAsm.exe (PID: 6712)
    • METASTEALER has been detected (SURICATA)

      • RegAsm.exe (PID: 6712)
    • REDLINE has been detected (SURICATA)

      • RegAsm.exe (PID: 6712)
    • Connects to the CnC server

      • RegAsm.exe (PID: 6712)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 6712)
    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 6712)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6796)
    • Starts a Microsoft application from unusual location

      • DAZN BOT.exe (PID: 6716)
    • Connects to unusual port

      • RegAsm.exe (PID: 6712)
    • Searches for installed software

      • RegAsm.exe (PID: 6712)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6796)
    • The process uses the downloaded file

      • WinRAR.exe (PID: 6796)
    • Checks supported languages

      • DAZN BOT.exe (PID: 6716)
      • RegAsm.exe (PID: 6712)
    • Reads the computer name

      • DAZN BOT.exe (PID: 6716)
      • RegAsm.exe (PID: 6712)
    • Manual execution by a user

      • DAZN BOT.exe (PID: 6716)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 6712)
    • Reads Environment values

      • RegAsm.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:07 17:49:00
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DAZN BOT /
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs dazn bot.exe no specs conhost.exe no specs installutil.exe no specs caspol.exe no specs #REDLINE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3540C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5888C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6500"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Version:
4.8.9037.0 built by: NET481REL1
6576"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
6712"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
DAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6716"C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exe" C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Network Realtime Inspection Service
Exit code:
4294967295
Version:
4.18.2104.5 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\dazn bot\dazn bot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6796"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
7 786
Read events
7 766
Write events
14
Delete events
6

Modification events

(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium
(PID) Process:(6712) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
381A0000742AB92E77FDDA01
Executable files
36
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpDetours.dllexecutable
MD5:F574ACDCB210E1F8BBC4733D3AF82D6F
SHA256:AF54DAC2F73F6FB212B5DCACFAC67B531CF0B79FC1E2FA6B82C5B895D892EC9F
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAsDesc.dllexecutable
MD5:BA2B29557FF5F4F3A7A55306D25B8D2B
SHA256:5BF78317F21A79E0E6D48D68C30532888A7F5B3B629EF240733BEFFF3619E9A2
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\ImagingBase.dllbinary
MD5:658E717D72A97B9D5D323A145B9CEEFC
SHA256:B98BF6CE40C7AE7ED6AC486E4CCB0EFD76F74345340D980BEB43585D6F3BCEA0
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\endpointdlp.dllexecutable
MD5:4433F83C04F409EAEA6E9D8E36708684
SHA256:4804AE834CA909178F3E9D6876209AA10851A36BC4EDAFD75A571E980013DA1D
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpEvMsg.dllexecutable
MD5:9DF51191844F79C00AD90076934496F8
SHA256:147E36A2C7B205CDA744D7F7F7DA17B9B60B26A4A62426FC169F82FD2687ACA0
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpOAV.dllexecutable
MD5:394C2ECAD239AA887188A7C8FDFC44B8
SHA256:F79C12ABBA8C5850906CB4D69A5B7F274786A7A4F6DCD94740C37FDF7FE0F290
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAzSubmit.dllexecutable
MD5:29FC71AA129A9497803A61161004AA61
SHA256:F3B280576FEB4AFBCBDE840007AA7BE5EBCE5E152256A65969D465F52B5A774E
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpClient.dllexecutable
MD5:75DC5B6480D544E1E4ED7B617735263E
SHA256:F175858BDF2326914198C66E253E6E4E850C45A32CB2A12A02B8277632A3571F
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpRtp.dllexecutable
MD5:B09A6E712989C71682B0B1593E4321E5
SHA256:CEEF3FA431FEEF63744A02F292E8435BFB9D02653FF5CA1E4E397A8EDA9B8C25
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpCommu.dllexecutable
MD5:5FB1AC615C3C72DF4DEC02A64B7FD379
SHA256:CA77DD6E870173AB419D43E56FB4446C6CF4493707287864049CE8B5E951DDEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
13
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3652
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
208
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
208
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
6456
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1356
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
1356
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
6712
RegAsm.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6712
RegAsm.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
No debug info