analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

129c0b07c81a8763a007f2dce9d8026715790854482bc8128ada46c66c74f265

Full analysis: https://app.any.run/tasks/e6ba778d-7b7b-4d28-8ce1-cc38e4b4f71c
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: March 14, 2019, 15:52:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
loader
rat
azorult
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: PC, Template: Normal.dotm, Last Saved By: PC, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 13 23:34:00 2019, Last Saved Time/Date: Wed Mar 13 23:34:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

75634FF334654987C5AE7E0E617A864F

SHA1:

92D6FBC32CFF704892FACF2DD5B6DCE58C16E961

SHA256:

129C0B07C81A8763A007F2DCE9D8026715790854482BC8128ADA46C66C74F265

SSDEEP:

1536:pYxSupfQcHOhWy9z40mamePd6ZpA+6LOA9iMPfaq1m:pASupzukCz40rd6Zmt9iMPC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 9501378.exe (PID: 3876)
      • 9501378.exe (PID: 3608)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2972)
    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2972)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 3892)
    • Connects to CnC server

      • 9501378.exe (PID: 3608)
    • Changes the autorun value in the registry

      • 9501378.exe (PID: 3876)
    • AZORULT was detected

      • 9501378.exe (PID: 3608)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3892)
      • 9501378.exe (PID: 3608)
    • Application launched itself

      • 9501378.exe (PID: 3876)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3892)
      • 9501378.exe (PID: 3876)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2972)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 15
CharCountWithSpaces: 1
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 1
Words: -
Pages: 1
ModifyDate: 2019:03:13 23:34:00
CreateDate: 2019:03:13 23:34:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 3
LastModifiedBy: PC
Template: Normal.dotm
Comments: -
Keywords: -
Author: PC
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 9501378.exe #AZORULT 9501378.exe

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\129c0b07c81a8763a007f2dce9d8026715790854482bc8128ada46c66c74f265.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3892C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass C:\Users\admin\AppData\Roaming\QOKurIv.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3876"C:\Users\admin\AppData\Roaming\9501378.exe" C:\Users\admin\AppData\Roaming\9501378.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3608"C:\Users\admin\AppData\Roaming\9501378.exe" C:\Users\admin\AppData\Roaming\9501378.exe
9501378.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
1 630
Read events
1 211
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2972WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR984E.tmp.cvr
MD5:
SHA256:
3892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0RRIN01C8JPFIBOTNWUF.temp
MD5:
SHA256:
3892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19a965.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
38769501378.exeC:\Users\admin\AppData\Local\Mozilla\Foxbinary
MD5:19297188335C66019E01618E1FEB8FC4
SHA256:1DDA2B78117D4CBB69F06B05FDAA70FAC6934BB50D746278F85AA8C8AE39348D
2972WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:6E28B672E33ED44FA2233E4B0EA4D984
SHA256:ECF9C6BE22E4A542EBECD6F2A9B2ABCD77BA994D3F8910570A44D4737F95D6E1
2972WINWORD.EXEC:\Users\admin\AppData\Roaming\QOKurIv.ps1text
MD5:062F49987559385EC2333029F56B1152
SHA256:0381B2563738B8B1B5693BFBE7848A4418154E86CE52AB9CD995A0A1ED90F48C
2972WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$9c0b07c81a8763a007f2dce9d8026715790854482bc8128ada46c66c74f265.docpgc
MD5:D0324FBC83DDF656181A698EA13C7F5F
SHA256:D9E44086679B115AAFEFEB53EEFD1D88AA2CBADA0EFB58425416FE349402FEC5
3892powershell.exeC:\Users\admin\AppData\Roaming\9501378.exeexecutable
MD5:43C2CC05F06310800E25DF6A13EE2637
SHA256:D7A930096FB7265FC09D94238A35EA931ECED0CE53654F5E6F8E7AB3C5A9CF89
38769501378.exeC:\Users\admin\AppData\Local\Mozilla\MiniCalc.exeexecutable
MD5:43C2CC05F06310800E25DF6A13EE2637
SHA256:D7A930096FB7265FC09D94238A35EA931ECED0CE53654F5E6F8E7AB3C5A9CF89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3892
powershell.exe
GET
200
107.180.27.166:80
http://mincoindia.com/wp-admin/AI/9501378.exe
US
executable
979 Kb
malicious
3608
9501378.exe
POST
200
185.195.236.146:80
http://llkty.gq/8s/index.php
AT
text
4 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3892
powershell.exe
107.180.27.166:80
mincoindia.com
GoDaddy.com, LLC
US
malicious
3608
9501378.exe
185.195.236.146:80
llkty.gq
Cristi Scumpu
AT
malicious

DNS requests

Domain
IP
Reputation
mincoindia.com
  • 107.180.27.166
malicious
llkty.gq
  • 185.195.236.146
malicious

Threats

PID
Process
Class
Message
3892
powershell.exe
A Network Trojan was detected
ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious
3892
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3892
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .gq Domain
3608
9501378.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3608
9501378.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
3608
9501378.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3608
9501378.exe
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.gq domain
1 ETPRO signatures available at the full report
No debug info