| download: | zxcvb.exe |
| Full analysis: | https://app.any.run/tasks/0e5ecb1a-2363-430e-bc22-fc9773cfbe01 |
| Verdict: | Malicious activity |
| Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
| Analysis date: | November 27, 2020, 03:59:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | B4BC1D711262CA156F8142ABFEAEE8B4 |
| SHA1: | 794F7B394BC77B17585D943FEF42C814044D94CD |
| SHA256: | 2BEA53A14D59FC7D772EA805AF47B3B8DDDDBF201A7E8D9E7EBD7CA422702A30 |
| SSDEEP: | 12288:KhAXRZL3U8hFuP1feqKoM/VStZtpLwCjAdXngGRU2Kw1aVcQnGDC51t8LF:GAhpUo41feqnMgLTMtQGRU2V4VcHDCl8 |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (72.2) |
|---|---|---|
| .scr | | | Windows screen saver (12.9) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.4) |
| .exe | | | Win32 Executable (generic) (4.4) |
| .exe | | | Generic Win/DOS Executable (1.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:11:18 16:28:28+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 754688 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xba3ca |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | Microsoft |
| FileDescription: | Monopoly Simulator |
| FileVersion: | 1.0.0.0 |
| InternalName: | 物的.exe |
| LegalCopyright: | Copyright © Microsoft 2017 - 2020 |
| LegalTrademarks: | - |
| OriginalFileName: | 物的.exe |
| ProductName: | Monopoly Simulator |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 18-Nov-2020 15:28:28 |
| Comments: | - |
| CompanyName: | Microsoft |
| FileDescription: | Monopoly Simulator |
| FileVersion: | 1.0.0.0 |
| InternalName: | 物的.exe |
| LegalCopyright: | Copyright © Microsoft 2017 - 2020 |
| LegalTrademarks: | - |
| OriginalFilename: | 物的.exe |
| ProductName: | Monopoly Simulator |
| ProductVersion: | 1.0.0.0 |
| Assembly Version: | 1.0.0.0 |
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 18-Nov-2020 15:28:28 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x000B83D0 | 0x000B8400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.88809 |
.rsrc | 0x000BC000 | 0x000005EC | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.19662 |
.reloc | 0x000BE000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 704 | C:\Windows\temp\xkwhcs2r.exe | C:\Windows\temp\xkwhcs2r.exe | — | cmd.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Disable-Windows-Defender Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1040 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1900 | "C:\Users\admin\AppData\Local\Temp\58aRCyOpya.exe" | C:\Users\admin\AppData\Local\Temp\58aRCyOpya.exe | — | zxcvb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSEInstall Package Exit code: 0 Version: 4.10.209.0 Modules
| |||||||||||||||
| 2164 | cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\admin\AppData\Local\Temp\zxcvb.exe" | C:\Windows\system32\cmd.exe | — | zxcvb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2372 | cmd /c start C:\Windows\temp\xkwhcs2r.exe | C:\Windows\system32\cmd.exe | — | DllHost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2456 | taskkill /IM cmstp.exe /F | C:\Windows\system32\taskkill.exe | — | DllHost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2460 | "C:\Users\admin\AppData\Local\Temp\WBjTJZW7YO.exe" | C:\Users\admin\AppData\Local\Temp\WBjTJZW7YO.exe | — | zxcvb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Framework 4 Setup Exit code: 0 Version: 4.0.30319.1 Modules
| |||||||||||||||
| 2744 | "C:\Windows\System32\svchost.exe" | C:\Windows\System32\svchost.exe | 9Wgk7Mpyxy.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2768 | "{path}" | C:\Users\admin\AppData\Local\Temp\azchgftrq.exe | azchgftrq.exe | ||||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Monopoly Simulator Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2828 | "C:\Users\admin\AppData\Local\Temp\azchgftrq.exe" | C:\Users\admin\AppData\Local\Temp\azchgftrq.exe | zxcvb.exe | ||||||||||||
User: admin Company: Microsoft Integrity Level: MEDIUM Description: Monopoly Simulator Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (3648) zxcvb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zxcvb_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3648 | zxcvb.exe | C:\Users\admin\AppData\Local\Temp\azchgftrq.exe | executable | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\1xVPfvJcrg | sqlite | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\rQF69AzBla | sqlite | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\n9h9r91h8fna789q\externalhand.jpg | image | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\frAQBc8Wsa | sqlite | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\RYwTiizs2t | sqlite | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\chrome_urls.txt | text | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\n9h9r91h8fna789q\formswho.rtf | text | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\rKB7tnhjlb | sqlite | |
MD5:— | SHA256:— | |||
| 2852 | zxcvb.exe | C:\Users\admin\AppData\LocalLow\n9h9r91h8fna789q\definedtraditional.jpg | image | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3648 | zxcvb.exe | GET | 200 | 217.8.117.77:80 | http://217.8.117.77/azchgftrq.exe | unknown | executable | 355 Kb | malicious |
2852 | zxcvb.exe | GET | 200 | 217.8.117.77:80 | http://217.8.117.77/rc.exe | unknown | executable | 1.33 Mb | malicious |
2900 | 9Wgk7Mpyxy.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D | US | der | 312 b | whitelisted |
2900 | 9Wgk7Mpyxy.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ%2FC8g3FP3hIILG%2FU1Ct2PZYCEQD5g7jF84adhvw3B5kCUueb | US | der | 280 b | whitelisted |
2852 | zxcvb.exe | GET | 200 | 217.8.117.77:80 | http://217.8.117.77/ac.exe | unknown | executable | 494 Kb | malicious |
3268 | ozchgftrq.exe | POST | 200 | 217.8.117.77:80 | http://taenaiaa.ac.ug/msvcp140.dll | unknown | executable | 429 Kb | malicious |
3268 | ozchgftrq.exe | POST | 200 | 217.8.117.77:80 | http://taenaiaa.ac.ug/softokn3.dll | unknown | executable | 141 Kb | malicious |
3268 | ozchgftrq.exe | POST | 200 | 217.8.117.77:80 | http://taenaiaa.ac.ug/freebl3.dll | unknown | executable | 326 Kb | malicious |
3268 | ozchgftrq.exe | POST | 200 | 217.8.117.77:80 | http://taenaiaa.ac.ug/nss3.dll | unknown | executable | 1.19 Mb | malicious |
3268 | ozchgftrq.exe | POST | 200 | 217.8.117.77:80 | http://taenaiaa.ac.ug/sqlite3.dll | unknown | executable | 630 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3648 | zxcvb.exe | 217.8.117.77:80 | morasergiox.ac.ug | — | — | malicious |
2852 | zxcvb.exe | 195.201.225.248:443 | telete.in | Awanti Ltd. | RU | suspicious |
2852 | zxcvb.exe | 217.8.117.77:80 | morasergiox.ac.ug | — | — | malicious |
2852 | zxcvb.exe | 104.27.133.115:443 | puffpuff423.top | Cloudflare Inc | US | malicious |
2828 | azchgftrq.exe | 217.8.117.77:80 | morasergiox.ac.ug | — | — | malicious |
2768 | azchgftrq.exe | 217.8.117.77:80 | morasergiox.ac.ug | — | — | malicious |
2900 | 9Wgk7Mpyxy.exe | 162.159.137.232:443 | discord.com | Cloudflare Inc | — | malicious |
2900 | 9Wgk7Mpyxy.exe | 162.159.133.233:443 | cdn.discordapp.com | Cloudflare Inc | — | shared |
2900 | 9Wgk7Mpyxy.exe | 151.139.128.14:80 | ocsp.comodoca.com | Highwinds Network Group, Inc. | US | suspicious |
3268 | ozchgftrq.exe | 217.8.117.77:80 | morasergiox.ac.ug | — | — | malicious |
Domain | IP | Reputation |
|---|---|---|
telete.in |
| shared |
puffpuff423.top |
| malicious |
morasergiox.ac.ug |
| malicious |
discord.com |
| whitelisted |
cdn.discordapp.com |
| shared |
ocsp.comodoca.com |
| whitelisted |
ocsp.comodoca4.com |
| whitelisted |
taenaia.ac.ug |
| malicious |
taenaiaa.ac.ug |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
3648 | zxcvb.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 37 |
3648 | zxcvb.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
3648 | zxcvb.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .exe file with no User-Agent |
3648 | zxcvb.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3648 | zxcvb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3648 | zxcvb.exe | Potentially Bad Traffic | ET INFO SUSPICIOUS Dotted Quad Host MZ Response |
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
2852 | zxcvb.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
2852 | zxcvb.exe | Potential Corporate Privacy Violation | AV POLICY HTTP request for .exe file with no User-Agent |
2852 | zxcvb.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |