download:

zxcvb.ps1

Full analysis: https://app.any.run/tasks/88e24875-f5aa-4217-ac0f-2e2c71ff9cfb
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: May 24, 2020, 12:38:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
stealer
vidar
rat
azorult
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

F218CF41378BE17B8EA1615093A10852

SHA1:

A27512B88A6B2AAE8C1AAB153FB065AA950E7C64

SHA256:

808A61F2421F8C3139E7FDC69A55A0FE8FF493D7D09AD0F9C18F135D9E075159

SSDEEP:

6144:gYReAtDIOCAXNIlUVe6WCQEf02G9Pnsv3gzCZdKE74TcuZPKU6YfQx5r:gtQFCAdQRhXzgY2GKUB05r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • chj.exe (PID: 3076)
      • chj.exe (PID: 1064)
      • axcbn.exe (PID: 2792)
      • cvcn.exe (PID: 3560)
      • axcbn.exe (PID: 2932)
      • cvcn.exe (PID: 1168)
    • Downloads executable files from the Internet

      • chj.exe (PID: 3076)
      • chj.exe (PID: 1064)
      • axcbn.exe (PID: 2792)
    • AZORULT was detected

      • axcbn.exe (PID: 2932)
    • VIDAR was detected

      • chj.exe (PID: 1064)
    • Connects to CnC server

      • axcbn.exe (PID: 2932)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2700)
      • chj.exe (PID: 3076)
      • axcbn.exe (PID: 2792)
      • chj.exe (PID: 1064)
    • Creates files in the user directory

      • powershell.exe (PID: 2700)
    • PowerShell script executed

      • powershell.exe (PID: 2700)
    • Application launched itself

      • chj.exe (PID: 3076)
      • axcbn.exe (PID: 2792)
      • cvcn.exe (PID: 3560)
    • Reads Internet Cache Settings

      • chj.exe (PID: 1064)
      • axcbn.exe (PID: 2932)
    • Creates files in the program directory

      • chj.exe (PID: 1064)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start powershell.exe chj.exe #VIDAR chj.exe axcbn.exe #AZORULT axcbn.exe cvcn.exe no specs cvcn.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1064"{path}"C:\Users\Public\chj.exe
chj.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\public\chj.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\netapi32.dll
1168"{path}"C:\Users\admin\AppData\Local\Temp\cvcn.execvcn.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cvcn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2700"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\zxcvb.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2792"C:\Users\admin\AppData\Local\Temp\axcbn.exe" C:\Users\admin\AppData\Local\Temp\axcbn.exe
chj.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\axcbn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2932"{path}"C:\Users\admin\AppData\Local\Temp\axcbn.exe
axcbn.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\axcbn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3076"C:\Users\Public\chj.exe"C:\Users\Public\chj.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\public\chj.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3560"C:\Users\admin\AppData\Local\Temp\cvcn.exe" C:\Users\admin\AppData\Local\Temp\cvcn.exeaxcbn.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Maze
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cvcn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 104
Read events
995
Write events
109
Delete events
0

Modification events

(PID) Process:(2700) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2700) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2700) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3076) chj.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
4
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2700powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0H7HO95AWGAFYI9MKQLT.temp
MD5:
SHA256:
2700powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa87434.TMPbinary
MD5:
SHA256:
3076chj.exeC:\Users\admin\AppData\Local\Temp\axcbn.exeexecutable
MD5:
SHA256:
2700powershell.exeC:\Users\Public\chj.exeexecutable
MD5:
SHA256:
2700powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:
SHA256:
2792axcbn.exeC:\Users\admin\AppData\Local\Temp\cvcn.exeexecutable
MD5:
SHA256:
1064chj.exeC:\ProgramData\sqlite3.dllexecutable
MD5:E477A96C8F2B18D6B5C27BDE49C990BF
SHA256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
4
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2792
axcbn.exe
GET
200
195.140.146.65:80
http://marckapiksa.ug/ds2.exe
unknown
executable
106 Kb
whitelisted
3076
chj.exe
GET
200
195.140.146.65:80
http://marckapiksa.ug/az2.exe
unknown
executable
212 Kb
whitelisted
1064
chj.exe
POST
195.140.146.65:80
http://vcvbjhscv.ru/softokn3.dll
unknown
malicious
1064
chj.exe
POST
200
195.140.146.65:80
http://vcvbjhscv.ru/sqlite3.dll
unknown
executable
630 Kb
malicious
2932
axcbn.exe
POST
200
195.140.146.65:80
http://svbx.ru/index.php
unknown
text
10 b
malicious
1064
chj.exe
POST
195.140.146.65:80
http://vcvbjhscv.ru/freebl3.dll
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3076
chj.exe
195.140.146.65:80
marckapiksa.ug
malicious
2792
axcbn.exe
195.140.146.65:80
marckapiksa.ug
malicious
1064
chj.exe
195.140.146.65:80
marckapiksa.ug
malicious
2932
axcbn.exe
195.140.146.65:80
marckapiksa.ug
malicious

DNS requests

Domain
IP
Reputation
marckapiksa.ug
  • 195.140.146.65
whitelisted
vcvbjhscv.ru
  • 195.140.146.65
malicious
svbx.ru
  • 195.140.146.65
malicious

Threats

PID
Process
Class
Message
3076
chj.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3076
chj.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3076
chj.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2792
axcbn.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2792
axcbn.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2792
axcbn.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2792
axcbn.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2932
axcbn.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
2932
axcbn.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2932
axcbn.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
3 ETPRO signatures available at the full report
No debug info