File name:

Purchase.exe

Full analysis: https://app.any.run/tasks/3cfadd9b-ff61-473a-ac39-f4d728a0f642
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 06:42:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
trojan
rat
azorult
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

B731A6C7110D0ED272E977BABAA204F6

SHA1:

90A7FC73FDCBF4D51AF667818BA4B22F15D6634A

SHA256:

DA6D45FD39478C021900718F516197EC10FCA556936A3960E13E787BDDA1B5EA

SSDEEP:

6144:r2GhNafuzces6tYAG5zyAHax1XOnJyut/u7b2PBCb+/MsqwltKAibwc8Np5:r2iNaGzKZYkm+UxPsZw1wv1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • Purchase.exe (PID: 2812)

    • AZORULT was detected

      • Purchase.exe (PID: 2812)

    • Loads dropped or rewritten executable

      • Purchase.exe (PID: 2812)

    • Actions looks like stealing of personal data

      • Purchase.exe (PID: 2812)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • Purchase.exe (PID: 2812)

    • Application launched itself

      • Purchase.exe (PID: 952)

    • Executable content was dropped or overwritten

      • Purchase.exe (PID: 2812)

    • Reads the cookies of Google Chrome

      • Purchase.exe (PID: 2812)

    • Reads the cookies of Mozilla Firefox

      • Purchase.exe (PID: 2812)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3716)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3716)

    • Manual execution by user

      • WINWORD.EXE (PID: 3716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:04 14:38:58+02:00
PEType: PE32
LinkerVersion: 48
CodeSize: 338944
InitializedDataSize: 211968
UninitializedDataSize: -
EntryPoint: 0x54a2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.1.2.5
ProductVersionNumber: 5.1.2.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Nvidia Corp
CompanyName: Nvidia
FileDescription: Nvidia Corp
FileVersion: 5.1.2.5
InternalName: Telegram.exe
LegalCopyright: Nvidia
OriginalFileName: Telegram.exe
ProductName: Nvidia Co
ProductVersion: 5.1.2.5
AssemblyVersion: 5.1.2.5

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-May-2020 12:38:58
Comments: Nvidia Corp
CompanyName: Nvidia
FileDescription: Nvidia Corp
FileVersion: 5.1.2.5
InternalName: Telegram.exe
LegalCopyright: Nvidia
OriginalFilename: Telegram.exe
ProductName: Nvidia Co
ProductVersion: 5.1.2.5
Assembly Version: 5.1.2.5

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 04-May-2020 12:38:58
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00052A34
0x00052C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.41677
.rsrc
0x00056000
0x0003397C
0x00033A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.27468
.reloc
0x0008A000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start purchase.exe no specs winword.exe no specs #AZORULT purchase.exe

Process information

PID
CMD
Path
Indicators
Parent process
952"C:\Users\admin\AppData\Local\Temp\Purchase.exe" C:\Users\admin\AppData\Local\Temp\Purchase.exe—explorer.exe
User:
admin
Company:
Nvidia
Integrity Level:
MEDIUM
Description:
Nvidia Corp
Exit code:
0
Version:
5.1.2.5
Modules
Images
c:\users\admin\appdata\local\temp\purchase.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2812"C:\Users\admin\AppData\Local\Temp\Purchase.exe"C:\Users\admin\AppData\Local\Temp\Purchase.exe
Purchase.exe
User:
admin
Company:
Nvidia
Integrity Level:
MEDIUM
Description:
Nvidia Corp
Exit code:
0
Version:
5.1.2.5
Modules
Images
c:\users\admin\appdata\local\temp\purchase.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3716"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\pathavailable.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
1 126
Read events
810
Write events
173
Delete events
143

Modification events

(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:j*)
Value:
6A2A2900840E0000010000000000000000000000
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
48
Suspicious files
0
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3716WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR66A.tmp.cvr —
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EA465DBB-1D0E-499D-9329-6B94C528BE83}.tmp —
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9672BAA1-98AE-4873-9FAB-2C910B62AC11}.tmp —
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{8CAC08D8-1A79-4EA9-9449-298CE95DC604}.tmp —
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\pathavailable.rtf.LNKlnk
MD5:—
SHA256:—
3716WINWORD.EXEC:\Users\admin\Desktop\~$thavailable.rtfpgc
MD5:—
SHA256:—
2812Purchase.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:CB978304B79EF53962408C611DFB20F5
SHA256:90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
2812Purchase.exeC:\Users\admin\AppData\Local\Temp\2fda\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:88FF191FD8648099592ED28EE6C442A5
SHA256:C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
1
DNS requests
1
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2812
Purchase.exe
POST
200
198.54.114.189:80
http://adtechsolutions.in/buda/32/index.php
US
binary
4.27 Mb
malicious
2812
Purchase.exe
POST
200
198.54.114.189:80
http://adtechsolutions.in/buda/32/index.php
US
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2812
Purchase.exe
198.54.114.189:80
adtechsolutions.in
Namecheap, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
adtechsolutions.in
  • 198.54.114.189
malicious

Threats

PID
Process
Class
Message
2812
Purchase.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2812
Purchase.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.2 Client Checkin M3
2812
Purchase.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2812
Purchase.exe
A Network Trojan was detected
AV TROJAN AZORult CnC Beacon
2812
Purchase.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult
2812
Purchase.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2812
Purchase.exe
A Network Trojan was detected
ET TROJAN AZORult v3.2 Server Response M3
2812
Purchase.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2812
Purchase.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2812
Purchase.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult v.3
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Purchase.exe