File name:

a2eac99addf30170e0cf67d4a5431b3ae7777a8f745c378c48b2f221f780eb0f

Full analysis: https://app.any.run/tasks/d4b8b54e-451a-493b-9714-eb0e2f71c7bb
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 08:48:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
loader
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

ED8AC5BAB132CFD041690334C8BFED8E

SHA1:

B5294A6AC9AB64FB95FEEE885F9B7893A4377D25

SHA256:

A2EAC99ADDF30170E0CF67D4A5431B3AE7777A8F745C378C48B2F221F780EB0F

SSDEEP:

192:P6WmTEW5zzCzmZ21nRsOgTdVZJhpnchPdS4xq4o+XI/v:S7Tf5KzZD3gTdVZnpi5qp5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TJClgGxXvpXdsjPB.exe (PID: 4052)
      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 2600)
      • MDEServer.exe (PID: 1164)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3132)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3132)

    • Uses Task Scheduler to run other applications

      • TJClgGxXvpXdsjPB.exe (PID: 4052)
      • MDEServer.exe (PID: 2600)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 3132)

    • Downloads executable files from IP

      • EQNEDT32.EXE (PID: 3132)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2768)
      • schtasks.exe (PID: 3020)

    • Actions looks like stealing of personal data

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • AZORULT was detected

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Connects to CnC server

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Loads dropped or rewritten executable

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3132)
      • TJClgGxXvpXdsjPB.exe (PID: 4052)
      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Application launched itself

      • TJClgGxXvpXdsjPB.exe (PID: 4052)
      • MDEServer.exe (PID: 2600)

    • Creates files in the user directory

      • TJClgGxXvpXdsjPB.exe (PID: 4052)

    • Connects to server without host name

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Reads the cookies of Google Chrome

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Reads the cookies of Mozilla Firefox

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

    • Starts CMD.EXE for commands execution

      • TJClgGxXvpXdsjPB.exe (PID: 3564)
      • MDEServer.exe (PID: 1164)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2796)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
12
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe tjclggxxvpxdsjpb.exe #AZORULT tjclggxxvpxdsjpb.exe schtasks.exe no specs cmd.exe no specs timeout.exe no specs mdeserver.exe no specs #AZORULT mdeserver.exe schtasks.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe"C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe
MDEServer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\sihost\mdeserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2600C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\sihost\mdeserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2768"C:\Windows\System32\schtasks.exe" /create /tn eudcedit /tr "C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—TJClgGxXvpXdsjPB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2796"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\a2eac99addf30170e0cf67d4a5431b3ae7777a8f745c378c48b2f221f780eb0f.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2820"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "MDEServer.exe"C:\Windows\system32\cmd.exe—MDEServer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2892"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "TJClgGxXvpXdsjPB.exe"C:\Windows\system32\cmd.exe—TJClgGxXvpXdsjPB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3020"C:\Windows\System32\schtasks.exe" /create /tn eudcedit /tr "C:\Users\admin\AppData\Roaming\sihost\MDEServer.exe" /sc minute /mo 1 /FC:\Windows\System32\schtasks.exe—MDEServer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3132"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3564"C:\Users\admin\AppData\Local\TJClgGxXvpXdsjPB.exe"C:\Users\admin\AppData\Local\TJClgGxXvpXdsjPB.exe
TJClgGxXvpXdsjPB.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\tjclggxxvpxdsjpb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3656C:\Windows\system32\timeout.exe 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
Total events
1 991
Read events
1 618
Write events
368
Delete events
5

Modification events

(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:>x$
Value:
3E782400EC0A0000010000000000000000000000
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2796) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1314062366
(PID) Process:(2796) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1314062480
(PID) Process:(2796) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1314062481
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
EC0A0000D83DCDDF2FC8D40100000000
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:#z$
Value:
237A2400EC0A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:#z$
Value:
237A2400EC0A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2796) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
98
Suspicious files
0
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
2796WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR88BE.tmp.cvr —
MD5:—
SHA256:—
4052TJClgGxXvpXdsjPB.exeC:\Users\admin\eudcedit.lnklnk
MD5:—
SHA256:—
3132EQNEDT32.EXEC:\Users\admin\AppData\Local\TJClgGxXvpXdsjPB.exeexecutable
MD5:—
SHA256:—
2796WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
2796WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$eac99addf30170e0cf67d4a5431b3ae7777a8f745c378c48b2f221f780eb0f.rtfpgc
MD5:—
SHA256:—
3564TJClgGxXvpXdsjPB.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:502263C56F931DF8440D7FD2FA7B7C00
SHA256:94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
3564TJClgGxXvpXdsjPB.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:CB978304B79EF53962408C611DFB20F5
SHA256:90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
4052TJClgGxXvpXdsjPB.exeC:\Users\admin\AppData\Roaming\sihost\MDEServer.exeexecutable
MD5:—
SHA256:—
3564TJClgGxXvpXdsjPB.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-localization-l1-2-0.dllexecutable
MD5:EFF11130BFE0D9C90C0026BF2FB219AE
SHA256:03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
3564TJClgGxXvpXdsjPB.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:E479444BDD4AE4577FD32314A68F5D28
SHA256:C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
4
DNS requests
0
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3132
EQNEDT32.EXE
GET
200
185.195.236.168:80
http://185.195.236.168/NjwjkNwdsvDgZwnRPjfhqHGkfbJDBhFfBwXzFbjFMP/Cashbag_Protected.exe
AT
executable
1.11 Mb
malicious
1164
MDEServer.exe
POST
200
185.195.236.178:80
http://185.195.236.178/cashbag/index.php
AT
txt
4.27 Mb
malicious
3564
TJClgGxXvpXdsjPB.exe
POST
200
185.195.236.178:80
http://185.195.236.178/cashbag/index.php
AT
text
5 b
malicious
3564
TJClgGxXvpXdsjPB.exe
POST
200
185.195.236.178:80
http://185.195.236.178/cashbag/index.php
AT
txt
4.27 Mb
malicious
1164
MDEServer.exe
POST
200
185.195.236.178:80
http://185.195.236.178/cashbag/index.php
AT
text
5 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3132
EQNEDT32.EXE
185.195.236.168:80
—
Cristi Scumpu
AT
malicious
3564
TJClgGxXvpXdsjPB.exe
185.195.236.178:80
—
Cristi Scumpu
AT
malicious
1164
MDEServer.exe
185.195.236.178:80
—
Cristi Scumpu
AT
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3132
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3132
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3132
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3132
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3564
TJClgGxXvpXdsjPB.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3564
TJClgGxXvpXdsjPB.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
3564
TJClgGxXvpXdsjPB.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3564
TJClgGxXvpXdsjPB.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
3564
TJClgGxXvpXdsjPB.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
3564
TJClgGxXvpXdsjPB.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a2eac99addf30170e0cf67d4a5431b3ae7777a8f745c378c48b2f221f780eb0f