| download: | zxcvb.ps1 |
| Full analysis: | https://app.any.run/tasks/88e24875-f5aa-4217-ac0f-2e2c71ff9cfb |
| Verdict: | Malicious activity |
| Threats: | AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. |
| Analysis date: | May 24, 2020, 12:38:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines |
| MD5: | F218CF41378BE17B8EA1615093A10852 |
| SHA1: | A27512B88A6B2AAE8C1AAB153FB065AA950E7C64 |
| SHA256: | 808A61F2421F8C3139E7FDC69A55A0FE8FF493D7D09AD0F9C18F135D9E075159 |
| SSDEEP: | 6144:gYReAtDIOCAXNIlUVe6WCQEf02G9Pnsv3gzCZdKE74TcuZPKU6YfQx5r:gtQFCAdQRhXzgY2GKUB05r |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1064 | "{path}" | C:\Users\Public\chj.exe | chj.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1168 | "{path}" | C:\Users\admin\AppData\Local\Temp\cvcn.exe | — | cvcn.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2700 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\zxcvb.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2792 | "C:\Users\admin\AppData\Local\Temp\axcbn.exe" | C:\Users\admin\AppData\Local\Temp\axcbn.exe | chj.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2932 | "{path}" | C:\Users\admin\AppData\Local\Temp\axcbn.exe | axcbn.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3076 | "C:\Users\Public\chj.exe" | C:\Users\Public\chj.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3560 | "C:\Users\admin\AppData\Local\Temp\cvcn.exe" | C:\Users\admin\AppData\Local\Temp\cvcn.exe | — | axcbn.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Maze Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| (PID) Process: | (2700) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2700) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2700) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3076) chj.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\chj_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2700 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0H7HO95AWGAFYI9MKQLT.temp | — | |
MD5:— | SHA256:— | |||
| 2700 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa87434.TMP | binary | |
MD5:— | SHA256:— | |||
| 3076 | chj.exe | C:\Users\admin\AppData\Local\Temp\axcbn.exe | executable | |
MD5:— | SHA256:— | |||
| 2700 | powershell.exe | C:\Users\Public\chj.exe | executable | |
MD5:— | SHA256:— | |||
| 2700 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 2792 | axcbn.exe | C:\Users\admin\AppData\Local\Temp\cvcn.exe | executable | |
MD5:— | SHA256:— | |||
| 1064 | chj.exe | C:\ProgramData\sqlite3.dll | executable | |
MD5:E477A96C8F2B18D6B5C27BDE49C990BF | SHA256:16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2792 | axcbn.exe | GET | 200 | 195.140.146.65:80 | http://marckapiksa.ug/ds2.exe | unknown | executable | 106 Kb | whitelisted |
3076 | chj.exe | GET | 200 | 195.140.146.65:80 | http://marckapiksa.ug/az2.exe | unknown | executable | 212 Kb | whitelisted |
1064 | chj.exe | POST | — | 195.140.146.65:80 | http://vcvbjhscv.ru/softokn3.dll | unknown | — | — | malicious |
1064 | chj.exe | POST | 200 | 195.140.146.65:80 | http://vcvbjhscv.ru/sqlite3.dll | unknown | executable | 630 Kb | malicious |
2932 | axcbn.exe | POST | 200 | 195.140.146.65:80 | http://svbx.ru/index.php | unknown | text | 10 b | malicious |
1064 | chj.exe | POST | — | 195.140.146.65:80 | http://vcvbjhscv.ru/freebl3.dll | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3076 | chj.exe | 195.140.146.65:80 | marckapiksa.ug | — | — | malicious |
2792 | axcbn.exe | 195.140.146.65:80 | marckapiksa.ug | — | — | malicious |
1064 | chj.exe | 195.140.146.65:80 | marckapiksa.ug | — | — | malicious |
2932 | axcbn.exe | 195.140.146.65:80 | marckapiksa.ug | — | — | malicious |
Domain | IP | Reputation |
|---|---|---|
marckapiksa.ug |
| whitelisted |
vcvbjhscv.ru |
| malicious |
svbx.ru |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
3076 | chj.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
3076 | chj.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3076 | chj.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2792 | axcbn.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
2792 | axcbn.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2792 | axcbn.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2792 | axcbn.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
2932 | axcbn.exe | A Network Trojan was detected | ET TROJAN Win32/AZORult V3.3 Client Checkin M2 |
2932 | axcbn.exe | A Network Trojan was detected | AV TROJAN Azorult CnC Beacon |
2932 | axcbn.exe | A Network Trojan was detected | STEALER [PTsecurity] AZORult v.3 |