analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

4.msi

Full analysis: https://app.any.run/tasks/13d01699-c57c-435b-ad1d-ec64c7d9c712
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: November 14, 2018, 15:52:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
rat
azorult
opendir
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

09379006CC321C5634F26C7AB949C67C

SHA1:

EBD3ACE4FE1E0A49F6C9749B5866979D83D5FB34

SHA256:

ED87F59E2E7A0DF65FDA70C3A6144012CCF1479AAB643368F4338330A7890AD9

SSDEEP:

24576:+Es0mQJzWd9c3WDomr2q+ylsYJ1//Dng:+EsbFoUOi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AZORULT was detected

      • MSI1791.tmp (PID: 2556)
    • Connects to CnC server

      • MSI1791.tmp (PID: 2556)
  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 2664)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2664)
  • INFO

    • Application was dropped or rewritten from another process

      • MSI1791.tmp (PID: 2556)
    • Searches for installed software

      • msiexec.exe (PID: 2664)
    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2724)
    • Starts application with an unusual extension

      • msiexec.exe (PID: 2664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
Words: -
Pages: 100
ModifyDate: 2013:05:21 11:56:44
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
LastModifiedBy: devuser
Template: ;0
Comments: -
Keywords: -
Author: www.exetomsi.com
Subject: -
Title: Exe to msi converter free
Software: Windows Installer
CreateDate: 2012:09:21 09:56:09
LastPrinted: 2012:09:21 09:56:09
CodePage: Windows Latin 1 (Western European)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs #AZORULT msi1791.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3284"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\4.msi"C:\Windows\System32\msiexec.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2664C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2724C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3016DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005C8" "000005C4"C:\Windows\system32\DrvInst.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2556"C:\Windows\Installer\MSI1791.tmp"C:\Windows\Installer\MSI1791.tmp
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Total events
489
Read events
313
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
6
Text files
103
Unknown types
0

Dropped files

PID
Process
Filename
Type
2664msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
3016DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:720FAB17D122BADBE624723F47D73899
SHA256:F948F893F31F30B957720D9A8DD7DCE4F0416C692155A01B0991C2A095A650C5
3016DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:80B77BD9EC39520E5F07B2BF31E363F3
SHA256:5358BA868639D8703C840259DBC92E99AD90507C3525B0613A78F065070C16B5
3016DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:2E7CC9F3669A9E524FB82F34041229C4
SHA256:2744D9ECA586AD600946903FF1B6A97FA0B01E08D4DB2BE654F445588CC187C2
2664msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:AF8A179DFBD5A23F258A06474861F3A2
SHA256:1CE3659DB7616C41B6567EF3C49E537288309BA030B49649CAEB051C2D8C7096
2664msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{6e84a251-6b79-4be7-855e-f9575e108794}_OnDiskSnapshotPropbinary
MD5:AF8A179DFBD5A23F258A06474861F3A2
SHA256:1CE3659DB7616C41B6567EF3C49E537288309BA030B49649CAEB051C2D8C7096
2724vssvc.exeC:
MD5:
SHA256:
2664msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFE0D35CBB7CA136A1.TMP
MD5:
SHA256:
2664msiexec.exeC:\Windows\Installer\16cdb7.ipibinary
MD5:F37BEAA14E4CA554DBDB7DB383715791
SHA256:44F7FD106523A99FE11842965FBC77A7F38965840F860FDC59C447C1D364D962
2664msiexec.exeC:\Windows\Installer\MSI16B4.tmpbinary
MD5:8E1A7FA927FEF3C1BC51F4B20E0BEE75
SHA256:D67FED57A9DBF7B91A3D43D163038E6784D27D7BEA75B2B5EC0E1D0EB9DA567A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
MSI1791.tmp
POST
103.63.2.245:80
http://rspl-sg.com/teryuiopw/index.php
HK
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2556
MSI1791.tmp
103.63.2.245:80
rspl-sg.com
Guochao Group limited
HK
suspicious

DNS requests

Domain
IP
Reputation
rspl-sg.com
  • 103.63.2.245
malicious

Threats

PID
Process
Class
Message
2556
MSI1791.tmp
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2556
MSI1791.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2556
MSI1791.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult encrypted PE file
2 ETPRO signatures available at the full report
No debug info