File name: | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28 |
Full analysis: | https://app.any.run/tasks/e584a8c4-c377-4888-8c4b-3fd33eb8c4ae |
Verdict: | Malicious activity |
Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
Analysis date: | January 10, 2025, 23:33:01 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
MD5: | B342FC1721147D746388D4BF6C987A04 |
SHA1: | BCB7F37269B927D2607578804BE99CE1EB85F72A |
SHA256: | 498421E2892EF6A315F64BE9517F62BF98434AC422D2EB881BFE6C6B6C92CB28 |
SSDEEP: | 98304:GAGQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRr:zv |
.exe | | | Win64 Executable (generic) (17.3) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (4.1) |
.exe | | | Win32 Executable (generic) (2.8) |
.exe | | | Generic Win/DOS Executable (1.2) |
ProductVersion: | ... |
---|---|
ProductName: | Adobe Download Manager |
LegalCopyright: | Copyright 2018 Adobe Incorporated. All rights reserved. |
FileVersion: | ... |
CompanyName: | Adobe Systems Incorporated |
OriginalFileName: | Adobe Download Manager |
FileDescription: | Adobe Download Manager |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0000 |
ProductVersionNumber: | 1.0.0.0 |
FileVersionNumber: | 1.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x27dcd |
UninitializedDataSize: | - |
InitializedDataSize: | 1527296 |
CodeSize: | 581120 |
LinkerVersion: | 12 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
TimeStamp: | 2019:03:12 13:38:44+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5008 | "C:\Users\admin\Desktop\498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe" | C:\Users\admin\Desktop\498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | explorer.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Download Manager Version: ... Modules
| |||||||||||||||
4624 | "C:\Users\admin\AppData\Local\Temp\vnc.exe" | C:\Users\admin\AppData\Local\Temp\vnc.exe | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
132 | C:\WINDOWS\system32\svchost.exe -k | C:\Windows\System32\svchost.exe | — | vnc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
5200 | "C:\Users\admin\AppData\Local\Temp\windef.exe" | C:\Users\admin\AppData\Local\Temp\windef.exe | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.3.0.0 Modules
| |||||||||||||||
2408 | "C:\Users\admin\Desktop\498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe" | C:\Users\admin\Desktop\498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Download Manager Exit code: 0 Version: ... Modules
| |||||||||||||||
5588 | "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F | C:\Windows\SysWOW64\schtasks.exe | — | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3076 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5096 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4624 -s 584 | C:\Windows\SysWOW64\WerFault.exe | vnc.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5316 | "C:\Users\admin\AppData\Roaming\SubDir\winsock.exe" | C:\Users\admin\AppData\Roaming\SubDir\winsock.exe | windef.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 1.3.0.0 Modules
|
(PID) Process: | (2408) 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2408) 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2408) 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (5200) windef.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing |
PID | Process | Filename | Type | |
---|---|---|---|---|
5096 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_77721ed9-b56e-4ff6-bfd5-d55449199c4f\Report.wer | — | |
MD5:— | SHA256:— | |||
5340 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_f9b3893d-dc5e-40dd-9c9e-265385789997\Report.wer | — | |
MD5:— | SHA256:— | |||
5316 | winsock.exe | C:\Users\admin\AppData\Roaming\Logs\01-10-2025 | binary | |
MD5:B22B45336A1DFF3695567E2CBF7632DB | SHA256:50B75EDADB5D772C56ECEA7546055A2A97B4A1E4173BC5DECD27EB9AA7AEDBDA | |||
5096 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E4C.tmp.WERInternalMetadata.xml | xml | |
MD5:9D0E46AE763E8B7259E7AACF1A06764A | SHA256:A34CC4A552810878BCF46368E61372EB83264AD98A8E815827A0BD959239BD01 | |||
5340 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER419D.tmp.xml | xml | |
MD5:EB1129148E06D96AD71A545B32685060 | SHA256:166A7EA14DF6FCCDEE3D12DCDD1A68895F399CA8702290921D1007B533E6FA06 | |||
5008 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | C:\Users\admin\AppData\Local\Temp\windef.exe | executable | |
MD5:B4A202E03D4135484D0E730173ABCC72 | SHA256:7050608D53F80269DF951D00883ED79815C060CE7678A76B5C3F6A2A985BEEA9 | |||
5096 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D9F.tmp.dmp | binary | |
MD5:41C70750095A955CC37CF5A680F5145F | SHA256:87CC221C56F0D2AAB9FAFA5A4337836BDC1A725BABA7FCD167F269DB447D1AC7 | |||
5008 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | C:\Users\admin\AppData\Local\Temp\vnc.exe | executable | |
MD5:B8BA87EE4C3FC085A2FED0D839AADCE1 | SHA256:4E8A99CD33C9E5C747A3CE8F1A3E17824846F4A8F7CB0631AEBD0815DB2CE3A4 | |||
5008 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | C:\Users\admin\btpanui\SystemPropertiesPerformance.exe | executable | |
MD5:F5C34D85C502584E561780095BD5BEC2 | SHA256:EEF0ECDD8C44CF267FC5950501459432FB283B4A3AC54AA8EC2C56B27ECEC230 | |||
5340 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER413D.tmp.dmp | binary | |
MD5:29494DB52636CF62D4B8DA2C0D452344 | SHA256:840F640B4FC65987D275A8A66810C9A4116BA03DD2442F7BF593E2D0FE8A44A0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2408 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | POST | 200 | 44.221.84.105:8000 | http://0x21.in:8000/_az/ | unknown | — | — | malicious |
2408 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | POST | — | 44.221.84.105:8000 | http://0x21.in:8000/_az/ | unknown | — | — | malicious |
1356 | svchost.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5200 | windef.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | — | — | shared |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1356 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5316 | winsock.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | — | — | shared |
2132 | SystemPropertiesPerformance.exe | POST | 200 | 44.221.84.105:8000 | http://0x21.in:8000/_az/ | unknown | — | — | malicious |
2132 | SystemPropertiesPerformance.exe | POST | — | 44.221.84.105:8000 | http://0x21.in:8000/_az/ | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1356 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
2408 | 498421e2892ef6a315f64be9517f62bf98434ac422d2eb881bfe6c6b6c92cb28.exe | 44.221.84.105:8000 | 0x21.in | AMAZON-AES | US | malicious |
1356 | svchost.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5096 | WerFault.exe | 104.208.16.94:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1356 | svchost.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
0x21.in |
| malicious |
crl.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ip-api.com |
| shared |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | A Network Trojan was detected | ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/AZORult V3.2 Client Checkin M13 |
— | — | A Network Trojan was detected | ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst |
— | — | Malware Command and Control Activity Detected | ET MALWARE Win32/AZORult V3.2 Client Checkin M13 |
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | A Network Trojan was detected | ET MALWARE Common RAT Connectivity Check Observed |
— | — | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | A Network Trojan was detected | ET MALWARE Common RAT Connectivity Check Observed |