analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

5.msi

Full analysis: https://app.any.run/tasks/a6186ae4-d6bb-4365-8139-897b4f022091
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: November 14, 2018, 15:51:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
rat
azorult
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

FB6B511E96E7BBFEC6DFCD14FC049430

SHA1:

FF85C0A4FF3309148C1F90286F61F8503170D763

SHA256:

9EE631BDB3AC7552254386A3AEEE6D8A3342D2D3F5B4E578A15A6800227680D3

SSDEEP:

12288:DEKE9i2KshZhNCE7NhOpp+GGXzM4jUOXnJHaWxwGRraNhF:DEKl3szhNCE7SpYfbIOXJLYJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AZORULT was detected

      • MSIE110.tmp (PID: 3572)
    • Connects to CnC server

      • MSIE110.tmp (PID: 3572)
  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3108)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3108)
  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3104)
    • Searches for installed software

      • msiexec.exe (PID: 3108)
    • Starts application with an unusual extension

      • msiexec.exe (PID: 3108)
    • Application was dropped or rewritten from another process

      • MSIE110.tmp (PID: 3572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
LastPrinted: 2012:09:21 09:56:09
CreateDate: 2012:09:21 09:56:09
Software: Windows Installer
Title: Exe to msi converter free
Subject: -
Author: www.exetomsi.com
Keywords: -
Comments: -
Template: ;0
LastModifiedBy: devuser
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
ModifyDate: 2013:05:21 11:56:44
Pages: 100
Words: -
Security: None
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs #AZORULT msie110.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3732"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\5.msi"C:\Windows\System32\msiexec.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3108C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3104C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3132DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005C0" "00000548"C:\Windows\system32\DrvInst.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3572"C:\Windows\Installer\MSIE110.tmp"C:\Windows\Installer\MSIE110.tmp
msiexec.exe
User:
admin
Company:
Softpointer Inc
Integrity Level:
MEDIUM
Description:
Sparse Nanometer Effects Void Mbiers
Total events
484
Read events
308
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
123
Unknown types
0

Dropped files

PID
Process
Filename
Type
3108msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
3108msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:593B7F960AE091E9EE4EFF51406CCA88
SHA256:64B3DC2E7592E919BB85A1DCAE9A711BF5EC1085AF4358F674F6C78B04D65609
3132DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:80B77BD9EC39520E5F07B2BF31E363F3
SHA256:5358BA868639D8703C840259DBC92E99AD90507C3525B0613A78F065070C16B5
3132DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:D3F24E5A92A5D16F8D4613A19375BE3A
SHA256:DC0D453B402587CA527426491D89D6286E1E38E658AFD7951D886B71AFFB3B2D
3108msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{4b7a7b48-8a23-45c1-9861-948a022d8bd1}_OnDiskSnapshotPropbinary
MD5:593B7F960AE091E9EE4EFF51406CCA88
SHA256:64B3DC2E7592E919BB85A1DCAE9A711BF5EC1085AF4358F674F6C78B04D65609
3132DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:A6D8B83B132787670CBF14B2216C341F
SHA256:664770A913D0E911DF1E2CB3EB4E3E303B4A56FC6495384E3100556B6106BF14
3104vssvc.exeC:
MD5:
SHA256:
3108msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFD1595F92C0D2D90A.TMP
MD5:
SHA256:
3108msiexec.exeC:\Windows\Installer\16d1cc.msiexecutable
MD5:FB6B511E96E7BBFEC6DFCD14FC049430
SHA256:9EE631BDB3AC7552254386A3AEEE6D8A3342D2D3F5B4E578A15A6800227680D3
3108msiexec.exeC:\Windows\Installer\MSIDF49.tmpbinary
MD5:0135831A07F55FA9793E9A9BC1D127DB
SHA256:50A3EF2374C719439790E2B4E7FDFD5B362EE5CA8919506C2E83D60A8A71CB4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3572
MSIE110.tmp
POST
103.63.2.245:80
http://slimiyt.us/michytery/index.php
HK
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
MSIE110.tmp
103.63.2.245:80
slimiyt.us
Guochao Group limited
HK
suspicious
216.58.206.14:80
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
slimiyt.us
  • 103.63.2.245
malicious

Threats

PID
Process
Class
Message
3572
MSIE110.tmp
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3572
MSIE110.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2 ETPRO signatures available at the full report
No debug info