File name:

RFQ-20203003.arj

Full analysis: https://app.any.run/tasks/0d5bdff7-f704-4ffb-b815-9ab22cdb65a3
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: March 31, 2020, 07:15:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
azorult
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F9374F181A491DA15DFEE90074071BAA

SHA1:

497DC7F3505B560B85E1B9B814EF3E12796ABD73

SHA256:

69B060D207D96639BACFF19687FD2F8C9028E5E799C6C8B92A4DD1140E8D7692

SSDEEP:

384:JtMehGk7b9HwklPRtD9q9mLssYb3IpAi69iV:jMg3Z7lPR1fLsRb4OXQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RFQ-20203003.exe (PID: 2348)
      • RFQ-20203003.exe (PID: 2972)
    • Loads dropped or rewritten executable

      • RFQ-20203003.exe (PID: 2972)
    • Connects to CnC server

      • RFQ-20203003.exe (PID: 2972)
    • Actions looks like stealing of personal data

      • RFQ-20203003.exe (PID: 2972)
    • AZORULT was detected

      • RFQ-20203003.exe (PID: 2972)
    • Changes settings of System certificates

      • RFQ-20203003.exe (PID: 2972)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • RFQ-20203003.exe (PID: 2972)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2728)
      • RFQ-20203003.exe (PID: 2972)
    • Creates files in the user directory

      • RFQ-20203003.exe (PID: 2972)
    • Reads the cookies of Google Chrome

      • RFQ-20203003.exe (PID: 2972)
    • Reads the cookies of Mozilla Firefox

      • RFQ-20203003.exe (PID: 2972)
    • Connects to server without host name

      • RFQ-20203003.exe (PID: 2972)
    • Adds / modifies Windows certificates

      • RFQ-20203003.exe (PID: 2972)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe rfq-20203003.exe no specs #AZORULT rfq-20203003.exe

Process information

PID
CMD
Path
Indicators
Parent process
2348"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2728.34696\rfq-20203003.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2728"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RFQ-20203003.arj.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2972"C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exe
RFQ-20203003.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\system32\mfc40.dll
c:\users\admin\appdata\local\temp\rar$exa2728.34696\rfq-20203003.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt40.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
4 024
Read events
455
Write events
2 382
Delete events
1 187

Modification events

(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2728) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RFQ-20203003.arj.rar
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2348) RFQ-20203003.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\konformeringtillidvkkendesrajahergwainsapfiskovotesticularun\LAUANUNINTERRUPTABLEMNGDEPARENTESERNEBOXLIKEINTERJUDGMENTSMAGG
Operation:writeName:modulenquadrifilarseptvrtdyretsdiscustomafskovnings
Value:
INDLSNINGSPROGRAMMERJOURNALISTELEVENSHARMONIKAMO
(PID) Process:(2972) RFQ-20203003.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
49
Suspicious files
6
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2972RFQ-20203003.exeC:\Users\admin\AppData\Local\Temp\Cab4EFE.tmp
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\Local\Temp\Tar4EFF.tmp
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72der
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:
SHA256:
2728WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2728.34696\RFQ-20203003.exeexecutable
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72binary
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\I4XN5B6K.txttext
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29der
MD5:
SHA256:
2972RFQ-20203003.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29binary
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
3
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
RFQ-20203003.exe
POST
200
192.227.215.147:80
http://192.227.215.147/panel/index.php
US
txt
4.27 Mb
malicious
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDL%2FQslYWVuogIAAAAAXGdc
US
der
472 b
whitelisted
2972
RFQ-20203003.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFOOHQjK5IlqCAAAAAAyCmA%3D
US
der
471 b
whitelisted
2972
RFQ-20203003.exe
POST
200
192.227.215.147:80
http://192.227.215.147/panel/index.php
US
text
5 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
RFQ-20203003.exe
172.217.23.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2972
RFQ-20203003.exe
172.217.23.97:443
doc-00-cc-docs.googleusercontent.com
Google Inc.
US
whitelisted
2972
RFQ-20203003.exe
192.227.215.147:80
ColoCrossing
US
malicious
2972
RFQ-20203003.exe
216.58.207.78:443
drive.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 216.58.207.78
shared
ocsp.pki.goog
  • 172.217.23.99
whitelisted
doc-00-cc-docs.googleusercontent.com
  • 172.217.23.97
whitelisted

Threats

PID
Process
Class
Message
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.2 Client Checkin M3
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN AZORult CnC Beacon
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2972
RFQ-20203003.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
2972
RFQ-20203003.exe
A Network Trojan was detected
ET TROJAN AZORult v3.2 Server Response M2
2972
RFQ-20203003.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2972
RFQ-20203003.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
1 ETPRO signatures available at the full report
No debug info