Edit tour

Windows Analysis Report
QT2hJT3Syn.exe

Overview

General Information

Sample name:	QT2hJT3Syn.exe renamed because original name is a hash value
Original sample name:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff.exe
Analysis ID:	1508523
MD5:	d19f3280851b5e9510a63fe7c80466ae
SHA1:	00e04653569a6d8244edff8765deec3d6ed9c15f
SHA256:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Tags:	116-198-231-169exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

C2 URLs / IPs found in malware configuration

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

One or more processes crash

PE file contains an invalid checksum

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QT2hJT3Syn.exe (PID: 6588 cmdline: "C:\Users\user\Desktop\QT2hJT3Syn.exe" MD5: D19F3280851B5E9510A63FE7C80466AE)

WerFault.exe (PID: 6108 cmdline: C:\Windows\system32\WerFault.exe -u -p 6588 -s 1388 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://116.198.231.169:63222/jquery-3.7.2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://www.microsoft.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.7.2.min.js"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x8ed3:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f3f:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0xa65:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xad1:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T10:58:45.805295+0200	2028765	3	Unknown Traffic	192.168.2.4	49730	116.198.231.169	63222	TCP
2024-09-10T10:58:49.904119+0200	2028765	3	Unknown Traffic	192.168.2.4	49733	116.198.231.169	63222	TCP
2024-09-10T10:58:54.035146+0200	2028765	3	Unknown Traffic	192.168.2.4	49736	116.198.231.169	63222	TCP
2024-09-10T10:58:58.765949+0200	2028765	3	Unknown Traffic	192.168.2.4	49741	116.198.231.169	63222	TCP
2024-09-10T10:59:02.875405+0200	2028765	3	Unknown Traffic	192.168.2.4	49748	116.198.231.169	63222	TCP
2024-09-10T10:59:06.930846+0200	2028765	3	Unknown Traffic	192.168.2.4	49751	116.198.231.169	63222	TCP
2024-09-10T10:59:10.998546+0200	2028765	3	Unknown Traffic	192.168.2.4	49754	116.198.231.169	63222	TCP
2024-09-10T10:59:15.034083+0200	2028765	3	Unknown Traffic	192.168.2.4	49757	116.198.231.169	63222	TCP
2024-09-10T10:59:19.109811+0200	2028765	3	Unknown Traffic	192.168.2.4	49760	116.198.231.169	63222	TCP
2024-09-10T10:59:23.134618+0200	2028765	3	Unknown Traffic	192.168.2.4	49763	116.198.231.169	63222	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QT2hJT3Syn.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://116.198.231.169:63222/jquery-3.7.2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}
Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://www.microsoft.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.7.2.min.js"}

Multi AV Scanner detection for submitted file

Source: QT2hJT3Syn.exe	ReversingLabs: Detection: 28%
Source: QT2hJT3Syn.exe	Virustotal: Detection: 31%			Perma Link

Source: QT2hJT3Syn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://116.198.231.169:63222/jquery-3.7.2.min.js
Source: Malware configuration extractor	URLs: http://116.198.231.169/jquery-3.7.2.min.js

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 116.198.231.169:63222

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49741 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49730 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49763 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49748 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49733 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49757 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49751 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49736 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49754 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49760 -> 116.198.231.169:63222

Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169

Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/c
Source: QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/
Source: QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/7:l
Source: QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/::g
Source: QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/=:z
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/Q:
Source: QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/_:
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/f
Source: QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.js
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.js#8
Source: QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.js;8
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jso9G
Source: QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1882778411.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jsw8
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/m:
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/nRouteHelper.dllj
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/t

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, type: DROPPED	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, type: DROPPED	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D9953EB0	0_2_00007FF7D9953EB0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D9952DC0	0_2_00007FF7D9952DC0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D99525E0	0_2_00007FF7D99525E0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D9954360	0_2_00007FF7D9954360
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D9952A60	0_2_00007FF7D9952A60
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_000000995739EB60	0_2_000000995739EB60

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6588 -s 1388

Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6588

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4cb44b40-c232-44b6-b9c0-fb70bd149dde

Jump to behavior

Source: QT2hJT3Syn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QT2hJT3Syn.exe	ReversingLabs: Detection: 28%
Source: QT2hJT3Syn.exe	Virustotal: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\QT2hJT3Syn.exe "C:\Users\user\Desktop\QT2hJT3Syn.exe"
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6588 -s 1388

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: QT2hJT3Syn.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QT2hJT3Syn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: QT2hJT3Syn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: QT2hJT3Syn.exe

Static PE information: real checksum: 0x118b0 should be: 0x1df90

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_000000995739EB7F push eax; ret		0_2_000000995739EDDB
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_000000995739EB60 push eax; ret		0_2_000000995739EDDB

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D08968000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR,
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Code function: 0_2_00007FF7D9952038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7D9952038

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D9952038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF7D9952038
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF7D995221C SetUnhandledExceptionFilter,		0_2_00007FF7D995221C

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Code function: 0_2_00007FF7D995228C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7D995228C

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match

File source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QT2hJT3Syn.exe	29%	ReversingLabs	Win64.Backdoor.Cobeacon
QT2hJT3Syn.exe	31%	Virustotal		Browse
QT2hJT3Syn.exe	100%	Avira	TR/AD.PatchedWinSwrort.uidrr

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/::g	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.js#8	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/7:l	0%	Avira URL Cloud	safe
https://116.198.231.169/c	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/m:	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/_:	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.js#8	0%	Virustotal		Browse
https://116.198.231.169:63222/f	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Virustotal		Browse
http://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Avira URL Cloud	safe
http://116.198.231.169/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/f	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.7.2.min.js;8	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.7.2.min.jso9G	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.jsw8	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/nRouteHelper.dllj	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/=:z	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/t	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/Q:	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Virustotal		Browse
https://116.198.231.169/	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://116.198.231.169:63222/jquery-3.7.2.min.js	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://116.198.231.169/jquery-3.7.2.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://116.198.231.169:63222/7:l	QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.js	QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169/c	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/::g	QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.js#8	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/m:	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/_:	QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/f	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/	QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.js;8	QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jso9G	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jsw8	QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1882778411.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1909422858.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/nRouteHelper.dllj	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/=:z	QT2hJT3Syn.exe, 00000000.00000003.2032084275.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2072522890.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2092768222.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2113063580.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2133525479.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2153550863.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2011741310.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/t	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/Q:	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2193997417.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.2173772952.0000022D089B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/	QT2hJT3Syn.exe, 00000000.00000002.2617523350.0000022D0897E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.198.231.169	unknown	China		137699	CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508523
Start date and time:	2024-09-10 10:57:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QT2hJT3Syn.exe renamed because original name is a hash value
Original Sample Name:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff.exe
Detection:	MAL
Classification:	mal92.troj.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
116.198.231.169	TEiot52yrz.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	TEiot52yrz.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	gOEF4WOJ3c.elf	Get hash	malicious	Unknown	Browse	116.198.238.210

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QT2hJT3Syn.exe_9773be4c1fb0eae18060de5a34e28b4a9399aa1_f3ab7727_a77f3ba9-fb32-4995-93cb-c27340063859\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9839308801033855
Encrypted:	false
SSDEEP:	192:8eg4X6S50I3D8jfP+PzuiFr9Z24lO8TU:PXKSaI3D8jwzuiFr9Y4lO8TU
MD5:	A33B898C59EC7EB478EF533F18A8023E
SHA1:	7667B449A892B9A1F10030B31A3697D2D3C17938
SHA-256:	C0FB1A4CA40558DAA9DEA896479ED2C97B0930F18DCEB149BC869A586B52A17C
SHA-512:	2B40290B5E3B5CDA6E63616BB51224D21984B7F0E7DEB12C7A3181F09AEE51A05446B0D95EC7C038735ED91289D6AAC6D163B40665DC7AB099B11155D77DB9B5
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.4.3.2.3.6.4.6.9.6.4.6.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.4.3.2.3.6.5.1.0.2.6.9.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.7.f.3.b.a.9.-.f.b.3.2.-.4.9.9.5.-.9.3.c.b.-.c.2.7.3.4.0.0.6.3.8.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.9.5.c.1.d.0.-.2.d.1.8.-.4.8.0.3.-.8.0.1.c.-.8.2.f.2.3.e.3.9.a.8.d.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.Q.T.2.h.J.T.3.S.y.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.c.-.0.0.0.1.-.0.0.1.4.-.1.d.c.1.-.f.4.9.f.5.f.0.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.5.7.6.0.0.8.f.d.d.c.2.3.1.c.4.b.6.b.8.e.a.6.2.2.3.3.e.0.9.7.0.0.0.0.0.0.9.0.4.!.0.0.0.0.0.0.e.0.4.6.5.3.5.6.9.a.6.d.8.2.4.4.e.d.f.f.8.7.6.5.d.e.e.c.3.d.6.e.d.9.c.1.5.f.!.Q.T.2.h.J.T.3.S.y.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.8././.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 10 08:59:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	154972
Entropy (8bit):	1.4614159444920982
Encrypted:	false
SSDEEP:	384:TqodCVjVSIRA6iv+gebrQ4UbLp/4O8f80yStE/GYSFW2exnCPT:TqodCZep/4O8fzF8xCL
MD5:	391E934405B2E7B61E8B8DC4E21F7775
SHA1:	91C5369017A2022CA8513F5F84F460F2C343BCDE
SHA-256:	988FEA3CE4F51007599A45D82064D4394E4B950A21E73D948463AEFA59F929FA
SHA-512:	C4E989F32068B2EC9D018398456BBE029BB7F49DF86ED1E7B3612AB43295E86E2AB99D999D0879F1E007D5EA449006B4B31A16527537A2D4B326C73B45A7808C
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp, Author: unknown
Reputation:	low
Preview:	MDMP..a..... .......l..f.........................................\..........T.......8...........T............5...'....................... ..............................................................................eJ......d!......Lw......................T...........=..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB63C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10230
Entropy (8bit):	3.7202987326664974
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8WC6Y9dRJc9gmfOTpDa89bkCVf0cgNsm:R6lXJNC6Y/RJc9gmfOVkofXC
MD5:	DEA7C9252430F5455C9DEBF74C678AF4
SHA1:	517A1B8EE134408400001D44DCD6A9E808CB0143
SHA-256:	F5F6C0B1B958216E20189890A5FA5772A3C35676BB1EAD6E91EE594DB5296576
SHA-512:	86936902079B5E6B9E2065770A8A0BA9DEB2A9A677C84CBD5EEB03C55069DBE5B45341B5C9DEC63DED740F6DB478FF0B9414581510ABDF9B4F05696474F92882
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB67C.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4693
Entropy (8bit):	4.506143139180314
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg771I9YDWpW8VYXYm8M4JYqQOKFEJyq85dpQOYlkFR/+d:uIjfbI7jy7VPJBQQJAQrlkFN+d
MD5:	A0C5450FCCD1F696127AC8FF8257B812
SHA1:	2B6ABEC9C569C41F8FC58ADCCEF10C63F8414B81
SHA-256:	72E2A0F5769C553AE01165F819FF4261B64CCF331F44BDC90529A4873F9A0008
SHA-512:	6768B7AC8394CBF3FA20C48CFE4753528C789DCA62C8DAA92B0299C7D117F415521BDD5C5233DBCF12CB354934546D8EF24BA1BB88C60622B79150A5B80B6390
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="493922" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465918874888848
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b48WSPKaJG8nAgejZMMhA2gX4WABl0uNrdwBCswSb5:BXD948WlLZMM6YFHB+5
MD5:	DB3FF01C4A73A5EBCB34B0CB83E90F52
SHA1:	859E353862D6D2C94C0D5D585B8106742197B435
SHA-256:	78B26CE99D43E6EDAE850A36BB3ECE413B2330B281BB70EB3F33385F459BBB19
SHA-512:	E6FF7F07FDEBD52B324EB2E52E8E59AA402804624322AC9D4B5E53383DAB1F8EC8D402591348C80BFFC32FB82F235F09DCB9A4E5D25FAFA916035D9999DB6A13
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..._................................................................................................................................................................................................................................................................................................................................................Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.269430115749708
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QT2hJT3Syn.exe
File size:	67'584 bytes
MD5:	d19f3280851b5e9510a63fe7c80466ae
SHA1:	00e04653569a6d8244edff8765deec3d6ed9c15f
SHA256:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
SHA512:	78650af411cfc8a1a1cf05a2538454fa5de7b3c6b6d80eef0193b1d3270389f69f998f1e80768f949167b6075aca1fd70be22b006e11fbd63a725c4097b3a99a
SSDEEP:	1536:mWHMTN/JJ86S4oqiEcpI6rAz/saT4c6WuC0J8:mWIJ8L1U/T4c6W70J8
TLSH:	D963BF9A7B428CFEE95613388123A49EF3F27C111B22ABFF47C601552D633D96C7A650
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Q...Q...Q...X.N.].......R.......X.......H.......W.......T...Q.......B...P...B...R...B...P...RichQ...................PE..d..

File Icon


Icon Hash:	0729494959591b1e

Static PE Info

General

Entrypoint:	0x140001cf4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B5A165 [Fri Aug 9 04:56:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6102f16ed129485447b57b8b35734f82

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F2414B207A4h
dec eax
add esp, 28h
jmp 00007F2414B2008Fh
int3
int3
jmp 00007F2414B209D6h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00004664h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00004649h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F2414B201E7h
dec eax
lea edx, dword ptr [000091C3h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F2414B208F8h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx
mov eax, 00000001h
cpuid
inc ebp
or edx, eax
mov dword ptr [ebp-10h], eax
inc ecx
xor ecx, 756E6547h
mov dword ptr [ebp-0Ch], ebx
inc ebp
or edx, ecx
mov dword ptr [ebp-08h], ecx
mov edi, ecx
mov dword ptr [ebp-04h], edx
jne 00007F2414B2026Dh
dec eax
or dword ptr [0000A26Dh], FFFFFFFFh
and eax, 0FFF3FF0h
dec eax
mov dword ptr [00000055h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaff4	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x56ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd000	0x438	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0x70	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa3b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa270	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0x290	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4584	0x4600	d031826de6e0e6fb9ccc321e78e11d07	False	0.5434151785714286	data	6.374369452326817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x5bc4	0x5c00	d9c437122c60c894b2f54adf5a7e1a71	False	0.6548488451086957	data	7.210114059723916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x200	0x200	59db9f2a508b239ec802e9d0119966a6	False	0.26171875	DOS executable (block device driver \377\377\377\377\377\377)	2.224911641545331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xd000	0x438	0x600	221a3fb74e87cf68c7ec77be366c615c	False	0.3580729166666667	data	3.1722964215356337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0x70	0x200	81c0371bb37172bdb766a9f4233486e2	False	0.224609375	data	1.3216181203289816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x56ec	0x5800	568a6f175845f6ba67d1ccd2ac08b100	False	0.9483753551136364	data	7.839562838980695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf2a8	0x2ec	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0147058823529411
RT_ICON	0xf594	0x592	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0077138849929874
RT_ICON	0xfb28	0x8f4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0047993019197208
RT_ICON	0x1041c	0x156d	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0020054694621696
RT_ICON	0x1198c	0x324	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.013681592039801
RT_ICON	0x11cb0	0x60c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0071059431524547
RT_ICON	0x122bc	0x998	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0044788273615635
RT_ICON	0x12c54	0x16b3	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0018929616245051
RT_GROUP_ICON	0x14308	0x3e	data			0.8709677419354839
RT_GROUP_ICON	0x14348	0x3e	data			0.8870967741935484
RT_VERSION	0x14388	0x364	data	English	United States	0.5483870967741935

Imports

DLL	Import
KERNEL32.dll	HeapCreate, WaitForSingleObject, Sleep, LoadLibraryA, CreateThread, HeapAlloc, GetModuleHandleW, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, QueryPerformanceCounter
USER32.dll	MessageBoxW
MSVCP140.dll	?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?good@ios_base@std@@QEBA_NXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Xlength_error@std@@YAXPEBD@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__current_exception, _CxxThrowException, __current_exception_context, memcpy, __C_specific_handler, __std_exception_copy, __std_exception_destroy, __std_terminate, memset, memchr
api-ms-win-crt-string-l1-1-0.dll	isalnum, strcmp
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, _initterm, _register_thread_local_exe_atexit_callback, terminate, _c_exit, _set_app_type, exit, _exit, _seh_filter_exe, _get_narrow_winmain_command_line, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _invalid_parameter_noinfo_noreturn, _cexit
api-ms-win-crt-heap-l1-1-0.dll	free, _set_new_mode, malloc, _callnewh
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T10:58:45.805295+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49730	116.198.231.169	63222	TCP
2024-09-10T10:58:49.904119+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49733	116.198.231.169	63222	TCP
2024-09-10T10:58:54.035146+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49736	116.198.231.169	63222	TCP
2024-09-10T10:58:58.765949+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49741	116.198.231.169	63222	TCP
2024-09-10T10:59:02.875405+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49748	116.198.231.169	63222	TCP
2024-09-10T10:59:06.930846+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49751	116.198.231.169	63222	TCP
2024-09-10T10:59:10.998546+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49754	116.198.231.169	63222	TCP
2024-09-10T10:59:15.034083+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49757	116.198.231.169	63222	TCP
2024-09-10T10:59:19.109811+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49760	116.198.231.169	63222	TCP
2024-09-10T10:59:23.134618+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49763	116.198.231.169	63222	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 10:58:43.758131981 CEST	49730	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:43.764611006 CEST	63222	49730	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:43.764699936 CEST	49730	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:43.794102907 CEST	49730	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:43.799022913 CEST	63222	49730	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:45.805049896 CEST	63222	49730	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:45.805294991 CEST	49730	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:45.805345058 CEST	49730	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:45.808933020 CEST	49731	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:45.810237885 CEST	63222	49730	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:45.813857079 CEST	63222	49731	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:45.813951969 CEST	49731	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:45.814260006 CEST	49731	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:45.819109917 CEST	63222	49731	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.872833014 CEST	63222	49731	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.873039007 CEST	49731	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.873867989 CEST	49731	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.876543999 CEST	49732	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.879692078 CEST	63222	49731	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.882460117 CEST	63222	49732	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.882554054 CEST	49732	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.882685900 CEST	49732	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.888441086 CEST	49733	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.889218092 CEST	63222	49732	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.889324903 CEST	49732	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.894175053 CEST	63222	49733	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:47.894270897 CEST	49733	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.894575119 CEST	49733	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:47.900820017 CEST	63222	49733	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:49.902786016 CEST	63222	49733	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:49.904119015 CEST	49733	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:49.904270887 CEST	49733	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:49.909096956 CEST	63222	49733	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:49.911626101 CEST	49734	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:49.916635036 CEST	63222	49734	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:49.916728973 CEST	49734	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:49.917155027 CEST	49734	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:49.921955109 CEST	63222	49734	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.932179928 CEST	63222	49734	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.932280064 CEST	49734	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.932456017 CEST	49734	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.935085058 CEST	49735	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.938368082 CEST	63222	49734	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.940850019 CEST	63222	49735	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.940932989 CEST	49735	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.941056967 CEST	49735	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.944641113 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.946450949 CEST	63222	49735	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.946517944 CEST	49735	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.949587107 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:51.949978113 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.949978113 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:51.955117941 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.035084009 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.035145998 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.035249949 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.039737940 CEST	49737	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.337465048 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.361259937 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.361304998 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.683594942 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.683643103 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.691303015 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.691422939 CEST	63222	49737	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.691497087 CEST	49737	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.691737890 CEST	63222	49736	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:54.691773891 CEST	49736	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.691962957 CEST	49737	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:54.696837902 CEST	63222	49737	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.699539900 CEST	63222	49737	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.699625015 CEST	49737	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.699693918 CEST	49737	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.702323914 CEST	49740	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.704504013 CEST	63222	49737	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.707171917 CEST	63222	49740	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.707237959 CEST	49740	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.707395077 CEST	49740	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.712131023 CEST	49741	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.712840080 CEST	63222	49740	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.712881088 CEST	49740	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.716969967 CEST	63222	49741	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:56.717044115 CEST	49741	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.717350006 CEST	49741	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:56.722222090 CEST	63222	49741	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:58.765882015 CEST	63222	49741	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:58.765949011 CEST	49741	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:58.766026974 CEST	49741	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:58.766525030 CEST	49745	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:58.770963907 CEST	63222	49741	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:58.771466017 CEST	63222	49745	116.198.231.169	192.168.2.4
Sep 10, 2024 10:58:58.771534920 CEST	49745	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:58.771795034 CEST	49745	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:58:58.776650906 CEST	63222	49745	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.832192898 CEST	63222	49745	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.832271099 CEST	49745	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.832365036 CEST	49745	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.833012104 CEST	49747	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.837419033 CEST	63222	49745	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.838108063 CEST	63222	49747	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.838538885 CEST	49747	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.838646889 CEST	49747	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.840727091 CEST	49748	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.843666077 CEST	63222	49747	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.843720913 CEST	49747	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.845738888 CEST	63222	49748	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:00.845798969 CEST	49748	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.846127033 CEST	49748	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:00.851494074 CEST	63222	49748	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:02.875322104 CEST	63222	49748	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:02.875405073 CEST	49748	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:02.875494003 CEST	49748	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:02.876707077 CEST	49749	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:02.880296946 CEST	63222	49748	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:02.882599115 CEST	63222	49749	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:02.882678032 CEST	49749	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:02.882960081 CEST	49749	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:02.887773037 CEST	63222	49749	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.886533976 CEST	63222	49749	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.886703968 CEST	49749	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.886807919 CEST	49749	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.887306929 CEST	49750	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.891625881 CEST	63222	49749	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.892127037 CEST	63222	49750	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.892210007 CEST	49750	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.892318010 CEST	49750	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.894712925 CEST	49751	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.897375107 CEST	63222	49750	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.897455931 CEST	49750	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.899703979 CEST	63222	49751	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:04.899806976 CEST	49751	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.900156021 CEST	49751	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:04.905044079 CEST	63222	49751	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:06.930447102 CEST	63222	49751	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:06.930845976 CEST	49751	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:06.931231022 CEST	49751	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:06.934432983 CEST	49752	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:06.936003923 CEST	63222	49751	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:06.939294100 CEST	63222	49752	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:06.939366102 CEST	49752	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:06.939646006 CEST	49752	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:06.946193933 CEST	63222	49752	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.965465069 CEST	63222	49752	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.965533972 CEST	49752	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.965632915 CEST	49752	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.968099117 CEST	49753	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.971379995 CEST	63222	49752	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.974172115 CEST	63222	49753	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.974338055 CEST	49753	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.974338055 CEST	49753	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.978257895 CEST	49754	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.979873896 CEST	63222	49753	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.980103016 CEST	63222	49753	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.980156898 CEST	49753	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.983679056 CEST	63222	49754	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:08.983751059 CEST	49754	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.984019041 CEST	49754	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:08.989511013 CEST	63222	49754	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:10.997436047 CEST	63222	49754	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:10.998545885 CEST	49754	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:10.998631954 CEST	49754	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:10.999223948 CEST	49755	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:11.003457069 CEST	63222	49754	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:11.004076958 CEST	63222	49755	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:11.004259109 CEST	49755	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:11.004523039 CEST	49755	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:11.009325981 CEST	63222	49755	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.006623030 CEST	63222	49755	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.009548903 CEST	49755	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.009629965 CEST	49755	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.014522076 CEST	63222	49755	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.022764921 CEST	49756	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.028240919 CEST	63222	49756	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.028322935 CEST	49756	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.028503895 CEST	49756	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.030687094 CEST	49757	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.034523964 CEST	63222	49756	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.034580946 CEST	49756	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.035706997 CEST	63222	49757	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:13.035763979 CEST	49757	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.036000013 CEST	49757	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:13.041086912 CEST	63222	49757	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:15.033972979 CEST	63222	49757	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:15.034082890 CEST	49757	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:15.034157991 CEST	49757	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:15.036770105 CEST	49758	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:15.039926052 CEST	63222	49757	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:15.044568062 CEST	63222	49758	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:15.044646978 CEST	49758	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:15.044976950 CEST	49758	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:15.049789906 CEST	63222	49758	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.057945013 CEST	63222	49758	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.058547974 CEST	49758	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.063710928 CEST	49758	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.068033934 CEST	49759	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.069633961 CEST	63222	49758	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.072936058 CEST	63222	49759	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.074572086 CEST	49759	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.074695110 CEST	49759	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.076956034 CEST	49760	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.079726934 CEST	63222	49759	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.081867933 CEST	63222	49760	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:17.081948996 CEST	49759	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.081984043 CEST	49760	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.082261086 CEST	49760	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:17.087032080 CEST	63222	49760	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:19.104685068 CEST	63222	49760	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:19.109811068 CEST	49760	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:19.109885931 CEST	49760	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:19.112216949 CEST	49761	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:19.114890099 CEST	63222	49760	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:19.117077112 CEST	63222	49761	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:19.122566938 CEST	49761	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:19.122898102 CEST	49761	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:19.127803087 CEST	63222	49761	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.112323046 CEST	63222	49761	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.112386942 CEST	49761	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.112624884 CEST	49761	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.114809036 CEST	49762	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.117465019 CEST	63222	49761	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.119664907 CEST	63222	49762	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.119745016 CEST	49762	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.119862080 CEST	49762	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.124620914 CEST	49763	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.125508070 CEST	63222	49762	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.125562906 CEST	49762	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.129520893 CEST	63222	49763	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:21.129592896 CEST	49763	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.129798889 CEST	49763	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:21.134906054 CEST	63222	49763	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:23.134493113 CEST	63222	49763	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:23.134618044 CEST	49763	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:23.134712934 CEST	49763	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:23.137036085 CEST	49764	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:23.140155077 CEST	63222	49763	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:23.142083883 CEST	63222	49764	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:23.142164946 CEST	49764	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:23.142474890 CEST	49764	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:23.147934914 CEST	63222	49764	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:25.155025959 CEST	63222	49764	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:25.156979084 CEST	49764	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:25.157080889 CEST	49764	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:25.159776926 CEST	49765	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:25.161973000 CEST	63222	49764	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:25.164700985 CEST	63222	49765	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:25.164808989 CEST	49765	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:25.164947033 CEST	49765	63222	192.168.2.4	116.198.231.169
Sep 10, 2024 10:59:25.170629978 CEST	63222	49765	116.198.231.169	192.168.2.4
Sep 10, 2024 10:59:25.172998905 CEST	49765	63222	192.168.2.4	116.198.231.169

Target ID:	0
Start time:	04:58:37
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\QT2hJT3Syn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QT2hJT3Syn.exe"
Imagebase:	0x7ff7d9950000
File size:	67'584 bytes
MD5 hash:	D19F3280851B5E9510A63FE7C80466AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:59:24
Start date:	10/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6588 -s 1388
Imagebase:	0x7ff753dc0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	8.3%
Signature Coverage:	30.8%
Total number of Nodes:	266
Total number of Limit Nodes:	6

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7D9953EB0 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 302
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32 ref: 00007FF7D9953EE2
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D9953F05
memcpy.VCRUNTIME140 ref: 00007FF7D9953F8F
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D9954030
memset.VCRUNTIME140(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D99540B6
memset.VCRUNTIME140(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D9954106
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D995422B
VirtualProtect.KERNELBASE(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D9954261
LoadLibraryA.KERNEL32(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D995426A
CreateThread.KERNELBASE ref: 00007FF7D9954286
WaitForSingleObject.KERNEL32(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D9954294
HeapCreate.KERNEL32(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D99542A7
HeapAlloc.KERNEL32(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D99542BB
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D99542D1
Sleep.KERNEL32(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D99542DD

Part of subcall function 00007FF7D9951818: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7D995100E), ref: 00007FF7D9951832

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,00000000,?,00007FF7D9951C86), ref: 00007FF7D995432F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D9954351

Strings

rW/xHjl/tpwqf1jaiPmqhwLTh/9V+0ClGm9TOkOcD5z/T4vuhcMWvccRToRnKodSXfv3fSUMfPE6HBpgW6PiXjGOslgM0HbL2BrCFb+ChiWMg7HLEpejgVGYwPZdvNhe8n5PcmSJtUFshxv0HtreU7iJABqRT6gm2O7nG9z2fd6wruUBN/we2QsjOTQ3El7aaLkEhYWQTuVJnyogTuU1PjvIYQe4B6ZL7gaqArtsu8VAJJuT5mPIceKgQo8wZKJn6SdG, xrefs: 00007FF7D9953EFE
kernel32.dll, xrefs: 00007FF7D9954263
GetProcAddress, xrefs: 00007FF7D9954216
VirtualProtect, xrefs: 00007FF7D9954241

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: memcpy$CreateHeapmemset$AllocConcurrency::cancel_current_taskLibraryLoadMessageObjectProtectSingleSleepThreadVirtualWait_invalid_parameter_noinfo_noreturnmallocstrcmp
String ID: GetProcAddress$VirtualProtect$kernel32.dll$rW/xHjl/tpwqf1jaiPmqhwLTh/9V+0ClGm9TOkOcD5z/T4vuhcMWvccRToRnKodSXfv3fSUMfPE6HBpgW6PiXjGOslgM0HbL2BrCFb+ChiWMg7HLEpejgVGYwPZdvNhe8n5PcmSJtUFshxv0HtreU7iJABqRT6gm2O7nG9z2fd6wruUBN/we2QsjOTQ3El7aaLkEhYWQTuVJnyogTuU1PjvIYQe4B6ZL7gaqArtsu8VAJJuT5mPIceKgQo8wZKJn6SdG
API String ID: 1700708136-1027293778
Opcode ID: f9bc0d7294f68d03651fd688e6f71cc41f92d764ef2405ada01706ca51ef2039
Instruction ID: f0d27e86d9ef6be61ea0e342b8b0180f8515be6d89d6ed34f0fa05ef1f53d2f8
Opcode Fuzzy Hash: f9bc0d7294f68d03651fd688e6f71cc41f92d764ef2405ada01706ca51ef2039
Instruction Fuzzy Hash: 0AD1B322A08A8296EB90EF25D8403BEA771FB94798FD04233DA5E47AD5DE3CD585C710

Function 000000995739EB60 Relevance: 3.3, APIs: 2, Instructions: 295
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000003,00000003,00000002,00000001), ref: 000000995739EB7B

Part of subcall function 000000995739EB7F: HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 000000995739EB9A
Part of subcall function 000000995739EB7F: HttpSendRequestA.WININET(000000995739EBAD,000000995739EBAD), ref: 000000995739EBDE

Memory Dump Source

Source File: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Offset: 000000995739E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_995739e000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: HttpRequest$ConnectInternetOpenSend
String ID:
API String ID: 3744200278-0
Opcode ID: e3167bb3e8b5aeea410c5bda1354292710fbe9dd2fdc2113092930280f81d543
Instruction ID: dbf25d72eccec2f227d63f6de976f82066dc53d567e97cfad96d33bd07fcc7f5
Opcode Fuzzy Hash: e3167bb3e8b5aeea410c5bda1354292710fbe9dd2fdc2113092930280f81d543
Instruction Fuzzy Hash: 99A17A23198A954EEB2B4FBCA41A3777F91EB02320F2E059DD4C18B1D7D1708B06C769

Function 00007FF7D9951B80 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7D9951BA4
__scrt_release_startup_lock.LIBCMT ref: 00007FF7D9951C12
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951C60
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7D9951C65
_get_narrow_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951C6D
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951C96
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951CEB

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 3995423050-0
Opcode ID: 1a752565a283e8bc6c4718bd7f0bfa4515868e64581fd36a0b3e31664e51b0ac
Instruction ID: 69b56cc9a5adec860d5992b1a5074522abce95dc56b6ae516c926c44dfbd9fad
Opcode Fuzzy Hash: 1a752565a283e8bc6c4718bd7f0bfa4515868e64581fd36a0b3e31664e51b0ac
Instruction Fuzzy Hash: 61310721A0C10366FAE4BF65D4912BF92B1AFC538CFC44036E64D47297DE2EE8448270

Function 000000995739EB7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 000000995739EB9A
HttpSendRequestA.WININET(000000995739EBAD,000000995739EBAD), ref: 000000995739EBDE

Strings

U.;, xrefs: 000000995739EB95

Memory Dump Source

Source File: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Offset: 000000995739E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_995739e000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: HttpRequest$OpenSend
String ID: U.;
API String ID: 3451552748-4213443877
Opcode ID: 0673e6ba89fcafa97f45a20ababb8eb16fe70298331e982a3612c8fa0d542fd6
Instruction ID: e10573e55bde8a2d7ed99b925aa9476de2a0bd8041372df73260d5c183bf47e0
Opcode Fuzzy Hash: 0673e6ba89fcafa97f45a20ababb8eb16fe70298331e982a3612c8fa0d542fd6
Instruction Fuzzy Hash: F911DDA1388C0D1BF61D859D7C5A73620CAD3C8765F25812FB50EC33DADD68CD82412A

Function 000000995739EB26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000000995739EB41
InternetOpenA.WININET(00000000,00000000), ref: 000000995739EB59

Strings

wini, xrefs: 000000995739EB2A

Memory Dump Source

Source File: 00000000.00000002.2617351207.000000995739E000.00000040.00000010.00020000.00000000.sdmp, Offset: 000000995739E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_995739e000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 5f93fe04556e9114a692b7a8cb09660883b66be0f4b4a600167b52d13b5f35d2
Instruction ID: bb45c2289e3829e286df8f680c18b10cca86eb5cab7a22d65ef98a043250ee95
Opcode Fuzzy Hash: 5f93fe04556e9114a692b7a8cb09660883b66be0f4b4a600167b52d13b5f35d2
Instruction Fuzzy Hash: 6A01413209CA448FD32E4EB4680733B7AD1EB42B15F2654AEE0C3854A3C9300A428B96

Non-executed Functions

Function 00007FF7D9954360 Relevance: 15.9, APIs: 10, Instructions: 882
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D99539C0: isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,00000000), ref: 00007FF7D9953A51
Part of subcall function 00007FF7D99539C0: memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953ACC
Part of subcall function 00007FF7D99539C0: memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953B03

memcpy.VCRUNTIME140 ref: 00007FF7D99543C8
memcpy.VCRUNTIME140 ref: 00007FF7D99543F3
memcpy.VCRUNTIME140 ref: 00007FF7D9954446
memset.VCRUNTIME140 ref: 00007FF7D99544D1
memset.VCRUNTIME140 ref: 00007FF7D9954518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D995516F

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: memcpy$memchrmemset$_invalid_parameter_noinfo_noreturnisalnum
String ID:
API String ID: 581468037-0
Opcode ID: 8ef4aaa22b329a95060205e8a9b0493baab4ad5e0559fcd37528c45140d44259
Instruction ID: 9f4c1d521f33ee130f4a1e1d920e7bee8c6cb35660139c6ec939ca2ab225b17a
Opcode Fuzzy Hash: 8ef4aaa22b329a95060205e8a9b0493baab4ad5e0559fcd37528c45140d44259
Instruction Fuzzy Hash: AB8233726082D09BD7658F3894406FEBBA1F78A74DFC59126DB8A4B786CB3CE601C750

Function 00007FF7D9952038 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7D9952054
memset.VCRUNTIME140 ref: 00007FF7D9952078
RtlCaptureContext.KERNEL32 ref: 00007FF7D9952081
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7D995209B
RtlVirtualUnwind.KERNEL32 ref: 00007FF7D99520DC
memset.VCRUNTIME140 ref: 00007FF7D995210F
IsDebuggerPresent.KERNEL32 ref: 00007FF7D9952130
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7D995214D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7D9952158

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 9ffe9f7a2552eabd9cbd91c231be09652aabbf0b04a8f210b51f505912c4f0c6
Instruction ID: 5f31ed822c4f1a302e20c37660e086481b9544aa4a4073a86ed65979444e8419
Opcode Fuzzy Hash: 9ffe9f7a2552eabd9cbd91c231be09652aabbf0b04a8f210b51f505912c4f0c6
Instruction Fuzzy Hash: 55310F72609B8196EBA09F61E8407EFB374FB94748F84403ADA4E47B99DF38D548C720

Function 00007FF7D995228C Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7D99522B8
GetCurrentThreadId.KERNEL32 ref: 00007FF7D99522C6
GetCurrentProcessId.KERNEL32 ref: 00007FF7D99522D2
QueryPerformanceCounter.KERNEL32 ref: 00007FF7D99522E2

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0fbad5fd6f2767220c7461670684e260ec7aafaf3dc54847602cb2efa943320e
Instruction ID: 9191d2fef644d2339d4f55442282b2cfa8e67cc9e794f1f87bfcd0c8946df941
Opcode Fuzzy Hash: 0fbad5fd6f2767220c7461670684e260ec7aafaf3dc54847602cb2efa943320e
Instruction Fuzzy Hash: 88114F22B14B019AEB40EF71E8442BE73B4F75975CF840E32DA5D82754EF38D1548350

Function 00007FF7D99525E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF7D99526B3
memset.VCRUNTIME140 ref: 00007FF7D99526E6

Strings

, xrefs: 00007FF7D995264E

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-3916222277
Opcode ID: 10fe64071739a2ded2f0a5419cf26234a9cb385721e058ba0fcc83c8cc307c78
Instruction ID: 263062de2372a2493d4a89ea3e8ee431166fb694fbdfbfab59e642ef23cfe573
Opcode Fuzzy Hash: 10fe64071739a2ded2f0a5419cf26234a9cb385721e058ba0fcc83c8cc307c78
Instruction Fuzzy Hash: C1C11472B182918BE765DF2895507BE7BE0F789B49FC58036DA4D8B344DB78E601C720

Function 00007FF7D9952A60 Relevance: 1.7, APIs: 1, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d9fd08a1a3572f31eb62606a6418c6cd1bf873439365f6d5667c21df0fb5db
Instruction ID: 7c5b03349cbed545e928b68d974a78185850c9755451bef8f6d47d54165eaa3c
Opcode Fuzzy Hash: 68d9fd08a1a3572f31eb62606a6418c6cd1bf873439365f6d5667c21df0fb5db
Instruction Fuzzy Hash: E01246732087E48AC7508F2D98405AF7FA4F399B4AF894216EFC947786CA3DE615C760

Function 00007FF7D9952DC0 Relevance: 1.7, APIs: 1, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16f77bd1055aef42d53165e0a7d8d775166ff36071f674d1390ceb6bc1ed32d
Instruction ID: 54bc590f011b6dab066ab00251679cc791891b4f6cff1f2b4042aac5a9fc6b92
Opcode Fuzzy Hash: d16f77bd1055aef42d53165e0a7d8d775166ff36071f674d1390ceb6bc1ed32d
Instruction Fuzzy Hash: 821235736083E48AD7508F2D98444AFBBA4F399B49F8A8216DFC947782CA3CF515C720

Function 00007FF7D995221C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185bb21c631b42b625ea131c3156779a1e8468bba62d3009b45224cd70e431eb
Instruction ID: 8f0d5b23558e864e1e5b4f39ead441b918e2ba4f30dc9a04b0489f9ef8598563
Opcode Fuzzy Hash: 185bb21c631b42b625ea131c3156779a1e8468bba62d3009b45224cd70e431eb
Instruction Fuzzy Hash: 58A00126909802A1E699AF21A85043EA230AB94309BC14432C00D410649E2DE444C220

Function 00007FF7D9951260 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D99512B8
memcpy.VCRUNTIME140 ref: 00007FF7D9951328
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951397
memcpy.VCRUNTIME140 ref: 00007FF7D99513BA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D99513E7
memcpy.VCRUNTIME140 ref: 00007FF7D99514D4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7D9951511
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7D9951552

Strings

string too long, xrefs: 00007FF7D9951244

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemcpy$Concurrency::cancel_current_task
String ID: string too long
API String ID: 621473597-2556327735
Opcode ID: dc214a706161d04807a1c17e90786c25c00201b982d4ed9808e8b67d56e755a6
Instruction ID: cc40f91abf887c0f5d376aaf568c39a1904a0cc4651f66f37edeef6db9dbb9eb
Opcode Fuzzy Hash: dc214a706161d04807a1c17e90786c25c00201b982d4ed9808e8b67d56e755a6
Instruction Fuzzy Hash: E381F662B08781A5EA74AF61A14036EA371EB85BD8FD44636DB6D07BD5CF7CD091C320

Function 00007FF7D9951560 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7D99515BD
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7D99515DD
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7D99515ED
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7D9951636
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF7D9951666
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7D9951688
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7D99516CE
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7D99516D5
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7D99516E2

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3274656010-0
Opcode ID: 2d83f5bf139d5ddab99d305bf5690e1c03955fd8ff749a6140a8785ce57e8d76
Instruction ID: 84376d8d9806d87376a987c2b17d2e2e9b2b16a2a7078afb96af94a2abeabaaf
Opcode Fuzzy Hash: 2d83f5bf139d5ddab99d305bf5690e1c03955fd8ff749a6140a8785ce57e8d76
Instruction Fuzzy Hash: D5511E32609A4192EBA0AF1AE59023EE770EBC5B99FD5C533CA5E437A4CF3DD4468310

Function 00007FF7D99539C0 Relevance: 12.8, APIs: 10, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,00000000), ref: 00007FF7D9953A51
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953ACC
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953B03
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953B46
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF7D9953B89
memset.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF7D9953CC8
memchr.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF7D9953D02
memchr.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF7D9953D3F
memchr.VCRUNTIME140 ref: 00007FF7D9953D7E
memchr.VCRUNTIME140 ref: 00007FF7D9953DBD

Part of subcall function 00007FF7D9951260: memcpy.VCRUNTIME140 ref: 00007FF7D99514D4

Memory Dump Source

Source File: 00000000.00000002.2617790359.00007FF7D9951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D9950000, based on PE: true

Associated: 00000000.00000002.2617779419.00007FF7D9950000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617801917.00007FF7D9956000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617813626.00007FF7D995C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617825903.00007FF7D995D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d9950000_QT2hJT3Syn.jbxd

Similarity

API ID: memchr$isalnummemcpymemset
String ID:
API String ID: 2613388124-0
Opcode ID: 1c4aa18a20eb7564f907b3e35b9d161b37e06d40664dc32e136580126c14a596
Instruction ID: 0962f5fca76d92a470c94d9654088aba174ca76956501603f7e66c7b53c1a77b
Opcode Fuzzy Hash: 1c4aa18a20eb7564f907b3e35b9d161b37e06d40664dc32e136580126c14a596
Instruction Fuzzy Hash: BFD10722A09782A5EB41BF25940127EABB1EB81BECFD44636DD2D47BD5DE3CD446C320

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QT2hJT3Syn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QT2hJT3Syn.exe_9773be4c1fb0eae18060de5a34e28b4a9399aa1_f3ab7727_a77f3ba9-fb32-4995-93cb-c27340063859\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB570.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB63C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB67C.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
QT2hJT3Syn.exe

Function 00007FF7D9953EB0 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 302
memorysleeplibraryCOMMON

Function 000000995739EB60 Relevance: 3.3, APIs: 2, Instructions: 295
networkCOMMON

Function 00007FF7D9951B80 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Function 000000995739EB7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
networkCOMMON

Function 000000995739EB26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
librarynetworkCOMMON

Function 00007FF7D9954360 Relevance: 15.9, APIs: 10, Instructions: 882
COMMON

Function 00007FF7D9952038 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF7D995228C Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Function 00007FF7D99525E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 294
COMMON

Function 00007FF7D9951260 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 217
COMMON

Function 00007FF7D9951560 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Function 00007FF7D99539C0 Relevance: 12.8, APIs: 10, Instructions: 329
COMMON