| File name: | DAZN Tool Premium.zip |
| Full analysis: | https://app.any.run/tasks/75ea7f34-f25b-4cd5-b026-4bb55a9bc439 |
| Verdict: | Malicious activity |
| Threats: | MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations. |
| Analysis date: | September 02, 2024, 20:31:14 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | 9E37F8A2C6906DC050EBDE931417D5AD |
| SHA1: | 285C8A849DEAE7A974414B3B6DA5168E47C0C2F2 |
| SHA256: | F63641E48F64C50BBEF5A63110736F6DB4F3DC6B14284762AFC56A36EADBBF5F |
| SSDEEP: | 98304:Pgk7FbmndoeObKB2jbPASkRFY/7wTI4Ykwlqrwc34GljnhU5AzBccuW+k+ykmUwD:b+QvlsOBHG |
| .zip | | | ZIP compressed archive (100) |
|---|
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2024:08:07 17:49:00 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | DAZN BOT / |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 236 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | DAZN BOT.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1812 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3540 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5888 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6500 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | — | DAZN BOT.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Framework CAS Policy Manager Version: 4.8.9037.0 built by: NET481REL1 | |||||||||||||||
| 6576 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | — | DAZN BOT.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.8.9037.0 built by: NET481REL1 | |||||||||||||||
| 6712 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | DAZN BOT.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6716 | "C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exe" | C:\Users\admin\Desktop\DAZN BOT\DAZN BOT.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Network Realtime Inspection Service Exit code: 4294967295 Version: 4.18.2104.5 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6796 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium.zip | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6796) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium | |||
| (PID) Process: | (6712) RegAsm.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 381A0000742AB92E77FDDA01 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAzSubmit.dll | executable | |
MD5:29FC71AA129A9497803A61161004AA61 | SHA256:F3B280576FEB4AFBCBDE840007AA7BE5EBCE5E152256A65969D465F52B5A774E | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\endpointdlp.dll | executable | |
MD5:4433F83C04F409EAEA6E9D8E36708684 | SHA256:4804AE834CA909178F3E9D6876209AA10851A36BC4EDAFD75A571E980013DA1D | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpAsDesc.dll | executable | |
MD5:BA2B29557FF5F4F3A7A55306D25B8D2B | SHA256:5BF78317F21A79E0E6D48D68C30532888A7F5B3B629EF240733BEFFF3619E9A2 | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpEvMsg.dll | executable | |
MD5:9DF51191844F79C00AD90076934496F8 | SHA256:147E36A2C7B205CDA744D7F7F7DA17B9B60B26A4A62426FC169F82FD2687ACA0 | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpRtp.dll | executable | |
MD5:B09A6E712989C71682B0B1593E4321E5 | SHA256:CEEF3FA431FEEF63744A02F292E8435BFB9D02653FF5CA1E4E397A8EDA9B8C25 | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpSvc.dll | executable | |
MD5:86449A4A33D1E34D66E146D53E72FC3C | SHA256:2E85CC2A6F6DDF3D42FC258A8A9F3BCDBF46716B3C1BED09FDA7242DE1B245C2 | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\ProtectionManagement.dll | executable | |
MD5:DAE4004E0A642F88BE3029DC4FE3B1FF | SHA256:F532F803A9040930B10A880BA4D1ED62D44A15756C31A487EA8E90A67BFD3078 | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\EppManifest.dll | executable | |
MD5:E1414283B5FB25E3A0AA034104E187D3 | SHA256:5768486507CE07E7C387E409714244FE2A96B33D1666D24825AA181AC3CEF5BC | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\AMMonitoringProvider.dll | executable | |
MD5:F2AE2445AC7ECA1EE8480321B03241FA | SHA256:8DA3D256EF7DF249138D8E934FBD74FDA8F31C5B5758F26A757F2C686E1DEBDF | |||
| 6796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\DAZN Tool Premium\DAZN BOT\MpClient.dll | executable | |
MD5:75DC5B6480D544E1E4ED7B617735263E | SHA256:F175858BDF2326914198C66E253E6E4E850C45A32CB2A12A02B8277632A3571F | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3652 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
208 | SIHClient.exe | GET | 200 | 69.192.161.161:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
208 | SIHClient.exe | GET | 200 | 69.192.161.161:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6456 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1356 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1356 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3652 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3652 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
6712 | RegAsm.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
6712 | RegAsm.exe | Potentially Bad Traffic | ET INFO Microsoft net.tcp Connection Initialization Activity |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC - Id1Response |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
6712 | RegAsm.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |