Click to jump to signature section
Source: file.exe | Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
Source: file.exe | String found in binary or memory: http://ip-api.com/json |
Source: Amcache.hve.3.dr | String found in binary or memory: http://upx.sf.net |
Source: file.exe | String found in binary or memory: https://dotbit.me/a/ |
Source: file.exe, type: SAMPLE | Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown |
Source: file.exe, type: SAMPLE | Matched rule: Azorult Payload Author: kevoreilly |
Source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown |
Source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Azorult Payload Author: kevoreilly |
Source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown |
Source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Azorult Payload Author: kevoreilly |
Source: C:\Users\user\Desktop\file.exe | Code function: String function: 00716EFC appears 68 times | |
Source: C:\Users\user\Desktop\file.exe | Code function: String function: 00714590 appears 31 times | |
Source: C:\Users\user\Desktop\file.exe | Code function: String function: 007147F4 appears 46 times | |
Source: C:\Users\user\Desktop\file.exe | Code function: String function: 00713C0C appears 32 times | |
Source: C:\Users\user\Desktop\file.exe | Code function: String function: 007140E4 appears 32 times | |
Source: C:\Users\user\Desktop\file.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224 |
Source: file.exe | Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
Source: file.exe, type: SAMPLE | Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04 |
Source: file.exe, type: SAMPLE | Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload |
Source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04 |
Source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload |
Source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04 |
Source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE | Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload |
Source: classification engine | Classification label: mal92.spyw.winEXE@2/5@0/0 |
Source: C:\Windows\SysWOW64\WerFault.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2920 |
Source: unknown | Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" |
Source: C:\Users\user\Desktop\file.exe | Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071C020 push 0071B44Ch; ret | 0_2_0071C044 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00728024 push 00727450h; ret | 0_2_00728048 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00724810 push 00723C3Ch; ret | 0_2_00724834 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071581C push 00714C6Dh; ret | 0_2_00715865 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00721950 push 00720D7Ch; ret | 0_2_00721974 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071D930 push 0071CD5Ch; ret | 0_2_0071D954 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071D92C push 0071CD5Ch; ret | 0_2_0071D954 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00723104 push 00722530h; ret | 0_2_00723128 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071F1F8 push 0071E624h; ret | 0_2_0071F21C |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071B1D4 push 0071A604h; ret | 0_2_0071B1FC |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_007159D8 push 00714E04h; ret | 0_2_007159FC |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071B1D8 push 0071A604h; ret | 0_2_0071B1FC |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_007161C4 push 00715626h; ret | 0_2_0071621E |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_007259B0 push 00724DDCh; ret | 0_2_007259D4 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_007161BC push 00715626h; ret | 0_2_0071621E |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_007159A0 push 00714DCCh; ret | 0_2_007159C4 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0072799C push 00726DC8h; ret | 0_2_007279C0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071B278 push 0071A6A8h; ret | 0_2_0071B2A0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071B27C push 0071A6A8h; ret | 0_2_0071B2A0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00727A7C push 00726EA8h; ret | 0_2_00727AA0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071CA57 push 0071BE84h; ret | 0_2_0071CA7C |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071CA58 push 0071BE84h; ret | 0_2_0071CA7C |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00716230 push 0071565Ch; ret | 0_2_00716254 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071F230 push 0071E68Fh; ret | 0_2_0071F287 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00716229 push 0071565Ch; ret | 0_2_00716254 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00726214 push 00725640h; ret | 0_2_00726238 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00719A00 push 007194D4h; ret | 0_2_0071A0CC |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00719A08 push 007194D4h; ret | 0_2_0071A0CC |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0071EA0C push 0071DE38h; ret | 0_2_0071EA30 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00715B64 push 00714F90h; ret | 0_2_00715B88 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00716B18 push 00715F44h; ret | 0_2_00716B3C |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: Amcache.hve.3.dr | Binary or memory string: VMware |
Source: Amcache.hve.3.dr | Binary or memory string: VMware Virtual USB Mouse |
Source: Amcache.hve.3.dr | Binary or memory string: vmci.syshbin |
Source: Amcache.hve.3.dr | Binary or memory string: VMware, Inc. |
Source: Amcache.hve.3.dr | Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.3.dr | Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.3.dr | Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.3.dr | Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.3.dr | Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.3.dr | Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.3.dr | Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.3.dr | Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.3.dr | Binary or memory string: vmci.sys |
Source: Amcache.hve.3.dr | Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0 |
Source: Amcache.hve.3.dr | Binary or memory string: vmci.syshbin` |
Source: Amcache.hve.3.dr | Binary or memory string: \driver\vmci,\driver\pci |
Source: Amcache.hve.3.dr | Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.3.dr | Binary or memory string: VMware20,1 |
Source: Amcache.hve.3.dr | Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.3.dr | Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.3.dr | Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: Amcache.hve.3.dr | Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: Amcache.hve.3.dr | Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.3.dr | Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.3.dr | Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.3.dr | Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.3.dr | Binary or memory string: VMware Virtual RAM |
Source: Amcache.hve.3.dr | Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.3.dr | Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.3.dr | Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe |
Source: Amcache.hve.3.dr | Binary or memory string: msmpeng.exe |
Source: Amcache.hve.3.dr | Binary or memory string: c:\program files\windows defender\msmpeng.exe |
Source: Amcache.hve.3.dr | Binary or memory string: MsMpEng.exe |
Source: Yara match | File source: file.exe, type: SAMPLE |
Source: Yara match | File source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: Process Memory Space: file.exe PID: 2920, type: MEMORYSTR |
Source: Yara match | File source: file.exe, type: SAMPLE |
Source: Yara match | File source: 0.0.file.exe.710000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0.2.file.exe.710000.0.unpack, type: UNPACKEDPE |
Source: Yara match | File source: Process Memory Space: file.exe PID: 2920, type: MEMORYSTR |
Source: file.exe | String found in binary or memory: \electrum.dat |
Source: file.exe | String found in binary or memory: ta%\Electrum\wallets\ |
Source: file.exe | String found in binary or memory: TA%\Jaxx\Local Storage\ |
Source: file.exe | String found in binary or memory: TA%\Exodus\ |
Source: file.exe | String found in binary or memory: TA%\Jaxx\Local Storage\ |
Source: file.exe | String found in binary or memory: TA%\Ethereum\keystore\ |
Source: file.exe | String found in binary or memory: TA%\Exodus\ |
Source: file.exe | String found in binary or memory: TA%\Ethereum\keystore\ |
Source: file.exe | String found in binary or memory: TA%\Ethereum\keystore\ |
Source: file.exe | String found in binary or memory: ppdata%\Electrum-LTC\wallets\ |