analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

purchase.doc

Full analysis: https://app.any.run/tasks/59678ba8-4f31-40e5-a110-44e6bce1b3bb
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 14:53:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

8842B7217B824D86A4455E5F16F61489

SHA1:

0D0A14765B7B3992208F8E35038497AAE6978EA7

SHA256:

363F1E2D56C50BAFED197BC2E4542E2E41AD54A65A919AB5C8E78AFA5351724D

SSDEEP:

24576:VR1dSNls4SD8l3S8YBsSuumTetrkSM8E4DlOHzZ1zsKdOBNrZ8rz/4xv9OwXYSkV:E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • A.R (PID: 2496)
      • A.R (PID: 3644)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2916)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3424)

    • AZORULT was detected

      • A.R (PID: 3644)

    • Connects to CnC server

      • A.R (PID: 3644)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2916)

    • Loads dropped or rewritten executable

      • A.R (PID: 3644)

    • Actions looks like stealing of personal data

      • A.R (PID: 3644)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3424)

    • Starts application with an unusual extension

      • CmD.exe (PID: 4092)
      • A.R (PID: 2496)

    • Application launched itself

      • rundll32.exe (PID: 3032)
      • A.R (PID: 2496)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 3032)
      • WINWORD.EXE (PID: 2916)

    • Reads the cookies of Google Chrome

      • A.R (PID: 3644)

    • Reads the cookies of Mozilla Firefox

      • A.R (PID: 3644)

    • Executable content was dropped or overwritten

      • A.R (PID: 3644)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2916)
      • firefox.exe (PID: 2296)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2916)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3424)

    • Application launched itself

      • firefox.exe (PID: 2296)

    • Reads CPU info

      • firefox.exe (PID: 2296)

    • Reads settings of System Certificates

      • pingsender.exe (PID: 3512)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 2396)
      • pingsender.exe (PID: 3512)

    • Changes settings of System certificates

      • pingsender.exe (PID: 2396)
      • pingsender.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 57435
CharactersWithSpaces: 27
Characters: 24
Words: 4
Pages: 1
TotalEditTime: 1 minute
RevisionNumber: 3
ModifyDate: 2019:01:03 16:34:00
CreateDate: 2019:01:03 16:14:00
LastModifiedBy: wuyan
Author: wuyan
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
16
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe eqnedt32.exe cmd.exe no specs a.r no specs rundll32.exe no specs #AZORULT a.r rundll32.exe no specs mctadmin.exe no specs rundll32.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe

Process information

PID
CMD
Path
Indicators
Parent process
2916"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\purchase.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3424"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
4092CmD /c %tMp%\A.RC:\Windows\system32\CmD.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2496C:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R—CmD.exe
User:
admin
Company:
APOSTO2
Integrity Level:
MEDIUM
Description:
Chinanta
Exit code:
0
Version:
1.05.0007
3032"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\intl.cplC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3644:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R
A.R
User:
admin
Company:
APOSTO2
Integrity Level:
MEDIUM
Description:
Chinanta
Exit code:
0
Version:
1.05.0007
3788"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL input.dllC:\Windows\system32\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2420C:\Windows\system32\mctadmin.exeC:\Windows\system32\mctadmin.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MCTAdmin
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3516"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.RC:\Windows\system32\rundll32.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2296"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
65.0.2
Total events
2 648
Read events
1 307
Write events
0
Delete events
0

Modification events

No data
Executable files
49
Suspicious files
34
Text files
17
Unknown types
31

Dropped files

PID
Process
Filename
Type
2916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFE0F.tmp.cvr —
MD5:—
SHA256:—
2916WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:6F5920B47E86D4FD5D6A13574A89ADDE
SHA256:8042B4CB8D5210F331BFA6B5323D23C5C0490E65DDF4DE726712C5206AD78298
2916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase.doc.rtfpgc
MD5:DEDCCAAB73BAF20408970F1726076ABD
SHA256:9C1ABB007C95A9F6E3ED397B9C15DE7C7A800CDF93CE864B94323A49927C8112
2916WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9E51F443.emfemf
MD5:F7961E44FE51CEEE06391905162E18E0
SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D
2916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\A.Rexecutable
MD5:38ED9A09A746D5C4105F1944B6F23271
SHA256:C9258176D4F37C43BEB2A82A5D8F549745493BB1F96CE3F4FC0660433F940A18
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-memory-l1-1-0.dllexecutable
MD5:D500D9E24F33933956DF0E26F087FD91
SHA256:BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:E479444BDD4AE4577FD32314A68F5D28
SHA256:C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:88FF191FD8648099592ED28EE6C442A5
SHA256:C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:D97A1CB141C6806F0101A5ED2673A63D
SHA256:DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
3644A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-processenvironment-l1-1-0.dllexecutable
MD5:5F73A814936C8E7E4A2DFD68876143C8
SHA256:96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
15
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2296
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3644
A.R
POST
200
194.87.239.100:80
http://uzoeze.online/index.php
RU
text
2 b
malicious
2296
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2296
firefox.exe
POST
200
216.58.207.67:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
2296
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3644
A.R
POST
200
194.87.239.100:80
http://uzoeze.online/index.php
RU
binary
4.27 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2296
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2296
firefox.exe
216.58.207.74:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3644
A.R
194.87.239.100:80
uzoeze.online
JSC Mediasoft ekspert
RU
malicious
2296
firefox.exe
34.223.207.155:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
2296
firefox.exe
216.58.207.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2296
firefox.exe
52.27.229.90:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2296
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2296
firefox.exe
52.85.184.119:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
2296
firefox.exe
52.42.232.148:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2296
firefox.exe
54.230.93.172:443
tracking-protection.cdn.mozilla.net
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
uzoeze.online
  • 194.87.239.100
malicious
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.27.229.90
  • 54.200.51.65
  • 52.10.42.204
whitelisted
search.r53-2.services.mozilla.com
  • 52.10.42.204
  • 54.200.51.65
  • 52.27.229.90
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
tiles.services.mozilla.com
  • 52.42.232.148
  • 52.34.132.219
  • 52.43.40.243
  • 52.35.250.5
  • 35.166.92.58
  • 52.26.103.165
  • 52.43.91.152
  • 52.88.59.160
whitelisted
tiles.r53-2.services.mozilla.com
  • 52.88.59.160
  • 52.43.91.152
  • 52.26.103.165
  • 35.166.92.58
  • 52.35.250.5
  • 52.43.40.243
  • 52.34.132.219
  • 52.42.232.148
whitelisted
snippets.cdn.mozilla.net
  • 52.85.184.119
whitelisted

Threats

PID
Process
Class
Message
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Response
3644
A.R
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3644
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
3644
A.R
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
purchase.doc