| download: | payload.ps1 |
| Full analysis: | https://app.any.run/tasks/23b2e36e-6f70-47b6-912a-7a8ecad0dd01 |
| Verdict: | Malicious activity |
| Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
| Analysis date: | July 11, 2019, 20:55:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines |
| MD5: | 0CF05FC0E2B1F0FEE31B1B0C204BC7EB |
| SHA1: | 6C514FAB14234C71B42C871C9E06D536A5B3C482 |
| SHA256: | 6548AE6CF74F6009BA0C0D381C9E32D6468ACC18C4BA2F4636F2DA88C9D60DAB |
| SSDEEP: | 12288:bSYw5xWAEyddG9OF3yLH2X61XC2HpejxSQ:OYwLWAEUI/j1yjxJ |
MALICIOUS
Application was dropped or rewritten from another process
- iopl.exe (PID: 2800)
- iopl.exe (PID: 2968)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 2556)
- au4T6j7hTuRnPR5SZTr6eSg6R.exe (PID: 3480)
- Wda65x1xuIyAJ2PCGlBX1lH2Y.exe (PID: 3856)
- eKK9QZTIl443XGz8wu265cwR6.exe (PID: 2336)
- winidsi34dfg_signed.exe (PID: 2196)
- a2nw234efg354_signed.exe (PID: 2568)
- rfsd543fg354gdf_signed.exe (PID: 3036)
- rfds34hfgdf34.exe (PID: 2640)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
- Wda65x1xuIyAJ2PCGlBX1lH2Y.exe (PID: 2056)
Actions looks like stealing of personal data
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
Loads dropped or rewritten executable
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
Downloads executable files from the Internet
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
Connects to CnC server
- iopl.exe (PID: 2968)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
AZORULT was detected
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
GODZILLA was detected
- iopl.exe (PID: 2968)
SUSPICIOUS
PowerShell script executed
- powershell.exe (PID: 3100)
Executable content was dropped or overwritten
- powershell.exe (PID: 3100)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
- RegAsm.exe (PID: 3408)
- iopl.exe (PID: 2968)
Application launched itself
- iopl.exe (PID: 2800)
- Wda65x1xuIyAJ2PCGlBX1lH2Y.exe (PID: 3856)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 2556)
Creates files in the user directory
- powershell.exe (PID: 3100)
- iopl.exe (PID: 2968)
Reads the cookies of Google Chrome
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
Starts CMD.EXE for commands execution
- au4T6j7hTuRnPR5SZTr6eSg6R.exe (PID: 3480)
- eKK9QZTIl443XGz8wu265cwR6.exe (PID: 2336)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
- a2nw234efg354_signed.exe (PID: 2568)
- winidsi34dfg_signed.exe (PID: 2196)
Starts CMD.EXE for self-deleting
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
Reads internet explorer settings
- iopl.exe (PID: 2968)
Reads the cookies of Mozilla Firefox
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
INFO
Manual execution by user
- Wda65x1xuIyAJ2PCGlBX1lH2Y.exe (PID: 3856)
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 2556)
- au4T6j7hTuRnPR5SZTr6eSg6R.exe (PID: 3480)
- eKK9QZTIl443XGz8wu265cwR6.exe (PID: 2336)
Dropped object may contain Bitcoin addresses
- dwwpQzThss7BXhWUbepfSu2ox.exe (PID: 3584)
- iopl.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
64
Monitored processes
23
Malicious processes
4
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2056 | C:\Users\admin\AppData\Local\Temp\Wda65x1xuIyAJ2PCGlBX1lH2Y.exe" | C:\Users\admin\AppData\Local\Temp\Wda65x1xuIyAJ2PCGlBX1lH2Y.exe | — | Wda65x1xuIyAJ2PCGlBX1lH2Y.exe | |||||||||||
User: admin Company: PROSTERNUM10 Integrity Level: MEDIUM Description: distrustingly Exit code: 0 Version: 1.08.0005 Modules
| |||||||||||||||
| 2196 | "C:\Users\admin\AppData\Local\Temp\winidsi34dfg_signed.exe" | C:\Users\admin\AppData\Local\Temp\winidsi34dfg_signed.exe | — | dwwpQzThss7BXhWUbepfSu2ox.exe | |||||||||||
User: admin Company: apositejuzoz Integrity Level: MEDIUM Description: eyojeyeg Exit code: 0 Version: 7.11.15.19 Modules
| |||||||||||||||
| 2336 | "C:\Users\admin\AppData\Local\Temp\eKK9QZTIl443XGz8wu265cwR6.exe" | C:\Users\admin\AppData\Local\Temp\eKK9QZTIl443XGz8wu265cwR6.exe | — | explorer.exe | |||||||||||
User: admin Company: ofosoteyohijicuyunom Integrity Level: MEDIUM Description: ijehehih Exit code: 0 Version: 4.5.7.9 Modules
| |||||||||||||||
| 2464 | C:\Windows\system32\timeout.exe 3 | C:\Windows\system32\timeout.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2472 | "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\AppData\Local\Temp\a2nw234efg354_signed.exe:Zone.Identifier" | C:\Windows\System32\cmd.exe | — | a2nw234efg354_signed.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2556 | "C:\Users\admin\AppData\Local\Temp\dwwpQzThss7BXhWUbepfSu2ox.exe" | C:\Users\admin\AppData\Local\Temp\dwwpQzThss7BXhWUbepfSu2ox.exe | explorer.exe | ||||||||||||
User: admin Company: evaporometer Integrity Level: MEDIUM Description: Annalen Exit code: 0 Version: 3.3.6.4 Modules
| |||||||||||||||
| 2568 | "C:\Users\admin\AppData\Local\Temp\a2nw234efg354_signed.exe" | C:\Users\admin\AppData\Local\Temp\a2nw234efg354_signed.exe | — | dwwpQzThss7BXhWUbepfSu2ox.exe | |||||||||||
User: admin Company: unekatahifepupexagojocaf Integrity Level: MEDIUM Description: oqimofapet Exit code: 0 Version: 8.12.16.20 Modules
| |||||||||||||||
| 2640 | "C:\Users\admin\AppData\Local\Temp\rfds34hfgdf34.exe" | C:\Users\admin\AppData\Local\Temp\rfds34hfgdf34.exe | dwwpQzThss7BXhWUbepfSu2ox.exe | ||||||||||||
User: admin Company: JP Integrity Level: MEDIUM Description: brailles Exit code: 0 Version: 2.1.4.3 Modules
| |||||||||||||||
| 2772 | "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\AppData\Local\Temp\au4T6j7hTuRnPR5SZTr6eSg6R.exe:Zone.Identifier" | C:\Windows\System32\cmd.exe | — | au4T6j7hTuRnPR5SZTr6eSg6R.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2788 | "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\AppData\Local\Temp\eKK9QZTIl443XGz8wu265cwR6.exe:Zone.Identifier" | C:\Windows\System32\cmd.exe | — | eKK9QZTIl443XGz8wu265cwR6.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
659
Read events
544
Write events
114
Delete events
1
Modification events
| (PID) Process: | (3100) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3100) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3100) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iopl_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iopl_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iopl_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iopl_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2968) iopl.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iopl_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
Executable files
58
Suspicious files
2
Text files
1
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R47M8M6K361DRHYX9W22.temp | — | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Temp\dwwpQzThss7BXhWUbepfSu2ox.exe | executable | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Temp\au4T6j7hTuRnPR5SZTr6eSg6R.exe | executable | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Temp\Wda65x1xuIyAJ2PCGlBX1lH2Y.exe | executable | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Temp\eKK9QZTIl443XGz8wu265cwR6.exe | executable | |
MD5:— | SHA256:— | |||
| 3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF100b0e.TMP | binary | |
MD5:— | SHA256:— | |||
| 3100 | powershell.exe | C:\Users\Public\iopl.exe | executable | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\kanorgate[1].php | text | |
MD5:— | SHA256:— | |||
| 2968 | iopl.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019071120190712\index.dat | dat | |
MD5:— | SHA256:— | |||
| 3100 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
7
DNS requests
2
Threats
19
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2968 | iopl.exe | GET | 200 | 188.246.233.25:80 | http://fdghdf344.ru/gz/kanorgate.php?g=-994429369&k=ij8qpGocMAju06bXEjoLA1Fz9 | RU | text | 1.29 Mb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | POST | 200 | 188.246.233.25:80 | http://fdghdf344.ru/index.php | RU | binary | 4.28 Mb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | GET | 200 | 188.246.233.25:80 | http://fdghdf344.ru/a2nw234efg354_signed.exe | RU | executable | 359 Kb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | GET | 200 | 188.246.233.25:80 | http://fdghdf344.ru/rfds34hfgdf34.exe | RU | executable | 482 Kb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | GET | 200 | 188.246.233.25:80 | http://fdghdf344.ru/winidsi34dfg_signed.exe | RU | executable | 556 Kb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | GET | 200 | 188.246.233.25:80 | http://fdghdf344.ru/rfsd543fg354gdf_signed.exe | RU | executable | 338 Kb | malicious |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | POST | 200 | 188.246.233.25:80 | http://fdghdf344.ru/index.php | RU | text | 2 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | 188.246.233.25:80 | fdghdf344.ru | Kassir, Ltd. | RU | malicious |
2968 | iopl.exe | 188.246.233.25:80 | fdghdf344.ru | Kassir, Ltd. | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
shell.view |
| unknown |
fdghdf344.ru |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2968 | iopl.exe | A Network Trojan was detected | MALWARE [PTsecurity] Godzilla Loader |
2968 | iopl.exe | A Network Trojan was detected | MALWARE [PTsecurity] Godzilla Loader C2 Response |
2968 | iopl.exe | A Network Trojan was detected | ET TROJAN Windows executable base64 encoded |
2968 | iopl.exe | Misc activity | SUSPICIOUS [PTsecurity] Executable base64 Payload hide in HTML content |
2968 | iopl.exe | Misc activity | SUSPICIOUS [PTsecurity] Executable base64 Payload |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | A Network Trojan was detected | AV TROJAN Azorult CnC Beacon |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult.Stealer HTTP Header |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult Request |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | A Network Trojan was detected | AV TROJAN AZOrult++ CnC Response |
3584 | dwwpQzThss7BXhWUbepfSu2ox.exe | A Network Trojan was detected | MALWARE [PTsecurity] AZORult Response |
2 ETPRO signatures available at the full report
Process | Message |
|---|---|
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |
dwwpQzThss7BXhWUbepfSu2ox.exe | User32.dll |