analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

55.msi

Full analysis: https://app.any.run/tasks/0fbea0aa-c272-495c-8c03-1c7e3c076f97
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: November 15, 2018, 11:43:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
rat
azorult
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

C85CF0DFA2801FF99A97063F961B37A4

SHA1:

A69FD66B2569BD749A0142BA8F53B38D7448755A

SHA256:

82970BCF938FCFB390F3BC527BB3F87BB34559A0484727DB86CA4A08F4DD14C2

SSDEEP:

12288:/ER/sOFdDnI4m5RZ0EG8iHJyc65ozvIY9Y4k1q:/ERPjDnI4OBipyx5ozv1Y4V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AZORULT was detected

      • MSIE2EB.tmp (PID: 2068)
    • Connects to CnC server

      • MSIE2EB.tmp (PID: 2068)
  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3572)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3572)
    • Creates files in the user directory

      • MSIE2EB.tmp (PID: 2068)
  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2024)
    • Searches for installed software

      • msiexec.exe (PID: 3572)
    • Starts application with an unusual extension

      • msiexec.exe (PID: 3572)
    • Application was dropped or rewritten from another process

      • MSIE2EB.tmp (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
LastPrinted: 2012:09:21 09:56:09
CreateDate: 2012:09:21 09:56:09
Software: Windows Installer
Title: Exe to msi converter free
Subject: -
Author: www.exetomsi.com
Keywords: -
Comments: -
Template: ;0
LastModifiedBy: devuser
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
ModifyDate: 2013:05:21 11:56:44
Pages: 100
Words: -
Security: None
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs #AZORULT msie2eb.tmp

Process information

PID
CMD
Path
Indicators
Parent process
1392"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\55.msi"C:\Windows\System32\msiexec.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3572C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2024C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2184DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000004E0" "000005BC"C:\Windows\system32\DrvInst.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2068"C:\Windows\Installer\MSIE2EB.tmp"C:\Windows\Installer\MSIE2EB.tmp
msiexec.exe
User:
admin
Company:
News Corporation
Integrity Level:
MEDIUM
Description:
Rowprovider Settings Chances Verschluckt
Total events
505
Read events
329
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
103
Unknown types
0

Dropped files

PID
Process
Filename
Type
3572msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
2184DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:80B77BD9EC39520E5F07B2BF31E363F3
SHA256:5358BA868639D8703C840259DBC92E99AD90507C3525B0613A78F065070C16B5
2184DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:4DC049F4CB64A78BEC16A10487446501
SHA256:B6043C54009ED4C543A8B94BADA35C98FC0BFAA83D39B8F8833F63586BA2BD7F
3572msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c5ee5e13-999c-4e64-b5c6-3f25bf956a8b}_OnDiskSnapshotPropbinary
MD5:D98F11C44B15AA89FB29DE4D31713451
SHA256:7839F29CAC8F4B8BE866CD4670C5013B5A6F8EA53103D091BCF99C2B19D8C6F2
2184DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:A0B79E3CE3077061C70441B2AD2C3147
SHA256:3BD2C24A4FEAD72C44124639183A4214BC1AAD1841CDE068AC8A29B6ADCA16A2
3572msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:D98F11C44B15AA89FB29DE4D31713451
SHA256:7839F29CAC8F4B8BE866CD4670C5013B5A6F8EA53103D091BCF99C2B19D8C6F2
3572msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFB96A455D0F589975.TMP
MD5:
SHA256:
2024vssvc.exeC:
MD5:
SHA256:
3572msiexec.exeC:\Windows\Installer\5ddbf4.msiexecutable
MD5:C85CF0DFA2801FF99A97063F961B37A4
SHA256:82970BCF938FCFB390F3BC527BB3F87BB34559A0484727DB86CA4A08F4DD14C2
3572msiexec.exeC:\Windows\Installer\MSIE182.tmpbinary
MD5:D2C3DEA902F0A88B2E3C45EC0358EC0D
SHA256:E2BB7222FA4036A52EEB16EFE0B398A3A99C529F3014E3CA797BAEFD91BDCB77
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
MSIE2EB.tmp
POST
103.63.2.245:80
http://slimiyt.us/coastgard/index.php
HK
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2068
MSIE2EB.tmp
103.63.2.245:80
slimiyt.us
Guochao Group limited
HK
suspicious

DNS requests

Domain
IP
Reputation
slimiyt.us
  • 103.63.2.245
malicious

Threats

PID
Process
Class
Message
2068
MSIE2EB.tmp
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
2068
MSIE2EB.tmp
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2068
MSIE2EB.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2068
MSIE2EB.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult encrypted PE file
2 ETPRO signatures available at the full report
No debug info