File name:

DAZN Tool Premium.zip

Full analysis: https://app.any.run/tasks/75ea7f34-f25b-4cd5-b026-4bb55a9bc439
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Analysis date: September 02, 2024, 20:31:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
redline
metastealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

9E37F8A2C6906DC050EBDE931417D5AD

SHA1:

285C8A849DEAE7A974414B3B6DA5168E47C0C2F2

SHA256:

F63641E48F64C50BBEF5A63110736F6DB4F3DC6B14284762AFC56A36EADBBF5F

SSDEEP:

98304:Pgk7FbmndoeObKB2jbPASkRFY/7wTI4Ykwlqrwc34GljnhU5AzBccuW+k+ykmUwD:b+QvlsOBHG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Stealers network behavior

      • RegAsm.exe (PID: 6712)
    • REDLINE has been detected (SURICATA)

      • RegAsm.exe (PID: 6712)
    • METASTEALER has been detected (SURICATA)

      • RegAsm.exe (PID: 6712)
    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 6712)
    • Connects to the CnC server

      • RegAsm.exe (PID: 6712)
    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 6712)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6796)
    • Starts a Microsoft application from unusual location

      • DAZN BOT.exe (PID: 6716)
    • Connects to unusual port

      • RegAsm.exe (PID: 6712)
    • Searches for installed software

      • RegAsm.exe (PID: 6712)
  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6796)
    • Manual execution by a user

      • DAZN BOT.exe (PID: 6716)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6796)
    • Reads the computer name

      • DAZN BOT.exe (PID: 6716)
      • RegAsm.exe (PID: 6712)
    • Checks supported languages

      • DAZN BOT.exe (PID: 6716)
      • RegAsm.exe (PID: 6712)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 6712)
    • Reads Environment values

      • RegAsm.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:07 17:49:00
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: DAZN BOT /
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs dazn bot.exe no specs conhost.exe no specs installutil.exe no specs caspol.exe no specs #REDLINE regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3540C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5888C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6500"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Version:
4.8.9037.0 built by: NET481REL1
6576"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeDAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
6712"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
DAZN BOT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6716"C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exe" C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Network Realtime Inspection Service
Exit code:
4294967295
Version:
4.18.2104.5 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\dazn bot\dazn bot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6796"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
7 786
Read events
7 766
Write events
14
Delete events
6

Modification events

(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6796) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium
(PID) Process:(6712) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
381A0000742AB92E77FDDA01
Executable files
36
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAzSubmit.dllexecutable
MD5:29FC71AA129A9497803A61161004AA61
SHA256:F3B280576FEB4AFBCBDE840007AA7BE5EBCE5E152256A65969D465F52B5A774E
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\endpointdlp.dllexecutable
MD5:4433F83C04F409EAEA6E9D8E36708684
SHA256:4804AE834CA909178F3E9D6876209AA10851A36BC4EDAFD75A571E980013DA1D
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAsDesc.dllexecutable
MD5:BA2B29557FF5F4F3A7A55306D25B8D2B
SHA256:5BF78317F21A79E0E6D48D68C30532888A7F5B3B629EF240733BEFFF3619E9A2
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpEvMsg.dllexecutable
MD5:9DF51191844F79C00AD90076934496F8
SHA256:147E36A2C7B205CDA744D7F7F7DA17B9B60B26A4A62426FC169F82FD2687ACA0
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpRtp.dllexecutable
MD5:B09A6E712989C71682B0B1593E4321E5
SHA256:CEEF3FA431FEEF63744A02F292E8435BFB9D02653FF5CA1E4E397A8EDA9B8C25
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpSvc.dllexecutable
MD5:86449A4A33D1E34D66E146D53E72FC3C
SHA256:2E85CC2A6F6DDF3D42FC258A8A9F3BCDBF46716B3C1BED09FDA7242DE1B245C2
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\ProtectionManagement.dllexecutable
MD5:DAE4004E0A642F88BE3029DC4FE3B1FF
SHA256:F532F803A9040930B10A880BA4D1ED62D44A15756C31A487EA8E90A67BFD3078
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\EppManifest.dllexecutable
MD5:E1414283B5FB25E3A0AA034104E187D3
SHA256:5768486507CE07E7C387E409714244FE2A96B33D1666D24825AA181AC3CEF5BC
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\AMMonitoringProvider.dllexecutable
MD5:F2AE2445AC7ECA1EE8480321B03241FA
SHA256:8DA3D256EF7DF249138D8E934FBD74FDA8F31C5B5758F26A757F2C686E1DEBDF
6796WinRAR.exeC:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpClient.dllexecutable
MD5:75DC5B6480D544E1E4ED7B617735263E
SHA256:F175858BDF2326914198C66E253E6E4E850C45A32CB2A12A02B8277632A3571F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
13
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3652
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
208
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
208
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
6456
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1356
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
1356
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3652
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
6712
RegAsm.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6712
RegAsm.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
6712
RegAsm.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
No debug info