Play interactive tour

Edit tour

Analysis Report Booking_request.exe

Overview

General Information

Joe Sandbox Version:	28.0.0
Analysis ID:	53882
Start date:	24.02.2020
Start time:	11:04:08
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	true
Report type:	full
Sample file name:	Booking_request.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10x64 HVM (IE 11.1, Chrome 67, Firefox 61, Adobe Reader 18, Java 8 Update 171)
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java) AMSI enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spyw.evad.winEXE@3/0@1/1
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, sc.exe, dllhost.exe, BackgroundTransferHost.exe, wermgr.exe, conhost.exe, backgroundTaskHost.exe, CompatTelRunner.exe Excluded IPs from analysis (whitelisted): 52.142.119.134, 52.156.204.185, 52.229.171.202, 13.107.4.52, 13.68.93.109, 20.42.24.29, 40.91.91.94, 20.36.218.70, 2.18.68.82, 20.44.86.43, 40.90.22.190, 40.90.22.189, 40.90.22.191, 93.184.220.29, 104.18.24.243, 104.18.25.243, 40.112.91.29, 23.210.250.117, 92.122.213.194, 92.122.213.247, 52.164.221.179 Excluded domains from analysis (whitelisted): fe2.update.microsoft.com.nsatc.net, umwatson.trafficmanager.net, cs9.wac.phicdn.net, arc.msn.com.nsatc.net, ris-prod-atm-perf.trafficmanager.net, ocsp.msocsp.com, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, ocsp.digicert.com, login.live.com, sls.update.microsoft.com, www.msftconnecttest.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, ocsp.globalsign.cloud, fs.microsoft.com, sls.update.microsoft.com.akadns.net, settings-win.data.microsoft.com, e1723.g.akamaiedge.net, ipv4.login.msa.akadns6.net, v4ncsi.msedge.net, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, sls.emea.update.microsoft.com.akadns.net, 4-c-0003.c-msedge.net, fe2.update.microsoft.com, hostedocsp.globalsign.com, store-images.s-microsoft.com, ncsi.4-c-0003.c-msedge.net, login.msa.akadns6.net Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	100	0 - 100	Report FP / FN	false	Azorult

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Process Injection411	Software Packing1	Credential Dumping	Virtualization/Sandbox Evasion1	Application Deployment Software	Data from Local System	Data Compressed	Standard Non-Application Layer Protocol2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Virtualization/Sandbox Evasion1	Network Sniffing	Process Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Application Layer Protocol12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
External Remote Services	Windows Management Instrumentation	Accessibility Features	Path Interception	Process Injection411	Input Capture	Security Software Discovery311	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information	Credentials in Files	System Information Discovery2	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Masquerading	Account Manipulation	Remote System Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Signature Overview

Click to jump to signature section

AV Detection:

Machine Learning detection for sample

Show sources

Source: Booking_request.exe

Joe Sandbox ML: detected

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2029466 ET TROJAN Win32/AZORult V3.3 Client Checkin M13 192.168.2.3:49843 -> 45.147.197.20:80

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic

HTTP traffic detected: POST /index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: sh1006535.had.suContent-Length: 105Cache-Control: no-cacheData Raw: 00 00 00 26 66 99 26 66 9b 42 70 9d 33 70 9d 34 70 9d 37 16 ec 26 67 ea 26 66 97 26 66 9a 26 66 9f 26 66 9a 26 66 97 26 66 9e 26 66 99 42 70 9c 47 70 9d 30 70 9d 36 70 9d 35 70 9d 30 70 9d 30 70 9d 3b 13 8b 30 6c 8b 31 11 eb 45 70 9d 31 16 e8 41 70 9d 36 70 9d 30 70 9c 47 70 9d 35 14 eb 40 70 9d 31 70 9d 33 10 ec Data Ascii: &f&fBp3p4p7&g&f&f&f&f&f&f&fBpGp0p6p5p0p0p;0l1Ep1Ap6p0pGp5@p1p3

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: sh1006535.had.su

Posts data to webserver

Show sources

Source: unknown

Urls found in memory or binary data

Show sources

Source: svchost.exe, 00000006.00000003.586724359.0000000004DA0000.00000004.00000001.sdmp	String found in binary or memory: http://195.245.112.115/index.php
Source: Booking_request.exe, 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://ip-api.com/json
Source: Booking_request.exe, 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: https://dotbit.me/a/

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Azorult Payload Author: kevoreilly

PE / OLE file has an invalid certificate

Show sources

Source: Booking_request.exe

Static PE information: invalid certificate

Sample file is different than original file name gathered from version info

Show sources

Source: Booking_request.exe, 00000000.00000002.585333013.0000000000920000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenameuser32j% vs Booking_request.exe

Yara signature match

Show sources

Source: 00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: Booking_request.exe

Static PE information: Section: .rr ZLIB complexity 0.999912239225

Classification label

Show sources

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@3/0@1/1

Creates mutexes

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\A75A074CB-9414907A-356338F9-EF2CFB53-6AEC20EB
Source: C:\Users\user\Desktop\Booking_request.exe	Mutant created: \Sessions\1\BaseNamedObjects\b2Zm

PE file has an executable .text section and no other executable section

Show sources

Source: Booking_request.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

File read: C:\Users\user\Desktop\Booking_request.exe

Jump to behavior

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\Booking_request.exe 'C:\Users\user\Desktop\Booking_request.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe
Source: C:\Users\user\Desktop\Booking_request.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe	Jump to behavior

Submission file is bigger than most known malware samples

Show sources

Source: Booking_request.exe

Static file information: File size 1569992 > 1048576

PE file has a big raw section

Show sources

Source: Booking_request.exe

Static PE information: Raw size of .rr is bigger than: 0x100000 < 0x110a00

PE file contains a mix of data directories often seen in goodware

Show sources

Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Booking_request.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Booking_request.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: Booking_request.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

PE file contains a valid data directory to section mapping

Show sources

Source: Booking_request.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Booking_request.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Booking_request.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Booking_request.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Booking_request.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

PE file contains an invalid checksum

Show sources

Source: Booking_request.exe

Static PE information: real checksum: 0x18086a should be: 0x189dcc

PE file contains sections with non-standard names

Show sources

Source: Booking_request.exe

Static PE information: section name: .rr

Malware Analysis System Evasion:

Checks if the current machine is a sandbox (GetTickCount - Sleep)

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Function Chain: GetTickCount - Sleep - GetTickCount

Checks if the current machine is a sandbox (GlobalMemoryStatusEx - GetDesktopWindow - CreateToolhelp32Snapshot)

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Function Chain: GlobalMemoryStatusEx - GetDesktopWindow - CreateToolhelp32Snapshot

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: KERNEL32FRIDA-WINJECTOR-HELPER-32.EXE
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: USER32.DLLFRIDA-WINJECTOR-HELPER-64.EXE

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: VBoxService.exe
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: qemu-ga.exe
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: VBoxTray.exe
Source: Booking_request.exe, 00000000.00000002.585495140.000000000099E000.00000004.00020000.sdmp	Binary or memory string: VBoxTray.exeKernel32.dllKernel32GlobalMemoryStatusEx

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Process queried: DebugFlags

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 45.147.197.20 80

Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 41B000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 41D000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\Booking_request.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FDC008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\Booking_request.exe

Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\System32\svchost.exe

Jump to behavior

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Azorult

Show sources

Source: Yara match	File source: 00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Booking_request.exe PID: 1816, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4412, type: MEMORY

Yara detected Azorult Info Stealer

Show sources

Source: Yara match	File source: 00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Booking_request.exe PID: 1816, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4412, type: MEMORY

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

No simulations

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Booking_request.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x182a8:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18908:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19ff0:$v2: http://ip-api.com/json 0x18c62:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000000.00000002.588278543.0000000002945000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x964cc:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x96b2c:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x98214:$v2: http://ip-api.com/json 0x96e86:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000000.00000002.588062787.00000000027A9000.00000004.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x18618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1a360:$v2: http://ip-api.com/json 0x18fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000006.00000002.587143259.0000000000400000.00000040.00000001.sdmp	Azorult_1	Azorult Payload	kevoreilly	0x18878:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 ... 0x12cac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
Process Memory Space: Booking_request.exe PID: 1816	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: Booking_request.exe PID: 1816	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: svchost.exe PID: 4412	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: svchost.exe PID: 4412	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security

Unpacked PEs

No yara matches

Sigma Overview

No Sigma rule has matched

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Booking_request.exe

Overview

General Information

Detection

Confidence

Classification

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Networking:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Malware Configuration

Behavior Graph

Simulations

Behavior and APIs

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Screenshots

Thumbnails