Edit tour
Windows
Analysis Report
8LNER6Tma8.exe
Overview
General Information
| Sample name: | 8LNER6Tma8.exerenamed because original name is a hash value |
| Original sample name: | 9f48e2311b87096e2d6a9503a0eb7992ee074e585d311ac12d8744ed6c200349.exe |
| Analysis ID: | 1529787 |
| MD5: | f8abe45fd211e5e97b75f741e12b3b52 |
| SHA1: | 54b3aa098faaafb865dadd50731f1b8514cdcdb6 |
| SHA256: | 9f48e2311b87096e2d6a9503a0eb7992ee074e585d311ac12d8744ed6c200349 |
| Tags: | exeuser-adrian__luca |
| Infos: |  |
 | |
Detection
PureLog Stealer, XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected PureLog Stealer
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Uses dynamic DNS services
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
8LNER6Tma8.exe (PID: 5600 cmdline: "C:\Users\ user\Deskt op\8LNER6T ma8.exe" MD5: F8ABE45FD211E5E97B75F741E12B3B52)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["easynation.duckdns.org"], "Port": "36584", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| MALWARE_Win_RedLine | Detects RedLine infostealer | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| Click to see the 11 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_PureLogStealer | Yara detected PureLog Stealer | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Click to see the 51 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-10-09T12:20:53.704358+0200 | 2853193 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49983 | 176.126.114.74 | 36584 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing | |
|---|
| Source: | .Net Code: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00408C60 | |
| Source: | Code function: | 0_2_0040DC11 | |
| Source: | Code function: | 0_2_00407C3F | |
| Source: | Code function: | 0_2_00418CCC | |
| Source: | Code function: | 0_2_00406CA0 | |
| Source: | Code function: | 0_2_004028B0 | |
| Source: | Code function: | 0_2_0041A4BE | |
| Source: | Code function: | 0_2_00418244 | |
| Source: | Code function: | 0_2_00401650 | |
| Source: | Code function: | 0_2_00402F20 | |
| Source: | Code function: | 0_2_004193C4 | |
| Source: | Code function: | 0_2_00418788 | |
| Source: | Code function: | 0_2_00402F89 | |
| Source: | Code function: | 0_2_00402B90 | |
| Source: | Code function: | 0_2_004073A0 | |
| Source: | Code function: | 0_2_022B1020 | |
| Source: | Code function: | 0_2_022B1030 | |
| Source: | Code function: | 0_2_05AD9790 | |
| Source: | Code function: | 0_2_05AD7EB8 | |
| Source: | Code function: | 0_2_05C745C0 | |
| Source: | Code function: | 0_2_05C74E90 | |
| Source: | Code function: | 0_2_05C70040 | |
| Source: | Code function: | 0_2_05C74278 | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Command line argument: | 0_2_00413780 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0040E230 | |
| Source: | Code function: | 0_2_022B4F19 | |
| Source: | Code function: | 0_2_022B4F65 | |
| Source: | Code function: | 0_2_022B439F | |
| Source: | Code function: | 0_2_022B4F9F | |
| Source: | Code function: | 0_2_05C765F1 | |
| Source: | Code function: | 0_2_05C771A1 | |
| Source: | Code function: | 0_2_05C77211 | |
| Source: | Code function: | 0_2_05C77211 | |
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-32784 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040CE09 | |
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Code function: | 0_2_004019F0 | |
| Source: | Code function: | 0_2_0040ADB0 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040CE09 | |
| Source: | Code function: | 0_2_0040E61C | |
| Source: | Code function: | 0_2_00416F6A | |
| Source: | Code function: | 0_2_004123F1 | |
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 0_2_00417A20 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00412A15 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Disable or Modify Tools | 1 Input Capture | 1 System Time Discovery | Remote Services | 1 Input Capture | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 131 Virtualization/Sandbox Evasion | LSASS Memory | 151 Security Software Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 Native API | Logon Script (Windows) | Logon Script (Windows) | 11 Deobfuscate/Decode Files or Information | Security Account Manager | 131 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 2 Obfuscated Files or Information | NTDS | 2 Process Discovery | Distributed Component Object Model | Input Capture | 21 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Software Packing | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 24 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 61% | ReversingLabs | ByteCode-MSIL.Trojan.Zilla | ||
| 53% | Virustotal | Browse | ||
| 100% | Avira | TR/ATRAPS.Gen | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 9% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 9% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| easynation.duckdns.org | 176.126.114.74 | true | true |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 176.126.114.74 | easynation.duckdns.org | Ukraine | 9063 | SAARGATE-ASVSENETGmbHDE | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1529787 |
| Start date and time: | 2024-10-09 12:17:04 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 19s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 5 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 8LNER6Tma8.exerenamed because original name is a hash value |
| Original Sample Name: | 9f48e2311b87096e2d6a9503a0eb7992ee074e585d311ac12d8744ed6c200349.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@1/0@4/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 06:18:02 | API Interceptor |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| easynation.duckdns.org | Get hash | malicious | PureLog Stealer, XWorm | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SAARGATE-ASVSENETGmbHDE | Get hash | malicious | RHADAMANTHYS | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai, Gafgyt | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.216696003089153 |
| TrID: |
|
| File name: | 8LNER6Tma8.exe |
| File size: | 190'976 bytes |
| MD5: | f8abe45fd211e5e97b75f741e12b3b52 |
| SHA1: | 54b3aa098faaafb865dadd50731f1b8514cdcdb6 |
| SHA256: | 9f48e2311b87096e2d6a9503a0eb7992ee074e585d311ac12d8744ed6c200349 |
| SHA512: | 3d33ceb8ecf7653d089309c06a2adec34da999989aeb5f129c20f8b6664405bd3b760cb3cf29a9602e89b9223172c661535bcecc860a10f6a9c83e220454b87d |
| SSDEEP: | 3072:wDKW1LgppLRHMY0TBfJvjcTp5Xu8ZGc8Qwac51DhhRSC:wDKW1Lgbdl0TBBvjc/uBZVRhPr |
| TLSH: | AF14AE2075C1C2B3C4B6113144EACB7A9A7934310B7A95D7B7DD2BBA6E213E1A3352CD |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~...................f....PE..L...t..P..........#........ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x40cd2f |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x5000A574 [Fri Jul 13 22:47:16 2012 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 0 |
| File Version Major: | 5 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 0 |
| Import Hash: | bf5a4aa99e5b160f8521cadd6bfe73b8 |
| Instruction |
|---|
| call 00007F20C0B1AA96h |
| jmp 00007F20C0B14C59h |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| sub esp, 20h |
| mov eax, dword ptr [ebp+08h] |
| push esi |
| push edi |
| push 00000008h |
| pop ecx |
| mov esi, 0041F058h |
| lea edi, dword ptr [ebp-20h] |
| rep movsd |
| mov dword ptr [ebp-08h], eax |
| mov eax, dword ptr [ebp+0Ch] |
| pop edi |
| mov dword ptr [ebp-04h], eax |
| pop esi |
| test eax, eax |
| je 00007F20C0B14DBEh |
| test byte ptr [eax], 00000008h |
| je 00007F20C0B14DB9h |
| mov dword ptr [ebp-0Ch], 01994000h |
| lea eax, dword ptr [ebp-0Ch] |
| push eax |
| push dword ptr [ebp-10h] |
| push dword ptr [ebp-1Ch] |
| push dword ptr [ebp-20h] |
| call dword ptr [0041B000h] |
| leave |
| retn 0008h |
| ret |
| mov eax, 00413563h |
| mov dword ptr [004228E4h], eax |
| mov dword ptr [004228E8h], 00412C4Ah |
| mov dword ptr [004228ECh], 00412BFEh |
| mov dword ptr [004228F0h], 00412C37h |
| mov dword ptr [004228F4h], 00412BA0h |
| mov dword ptr [004228F8h], eax |
| mov dword ptr [004228FCh], 004134DBh |
| mov dword ptr [00422900h], 00412BBCh |
| mov dword ptr [00422904h], 00412B1Eh |
| mov dword ptr [00422908h], 00412AABh |
| ret |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| call 00007F20C0B14D4Bh |
| call 00007F20C0B1B5D0h |
| cmp dword ptr [ebp+00h], 00000000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x215b4 | 0x50 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x26000 | 0xc9a8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x1b1c0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x20da0 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x1b000 | 0x184 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x19718 | 0x19800 | a337efd058e0bb0d90f1ea2b95c23eb1 | False | 0.5789483762254902 | data | 6.748485713144432 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x1b000 | 0x6db4 | 0x6e00 | 5826801f33fc1b607aa8e942aa92e9fa | False | 0.5467329545454546 | data | 6.442956247632331 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x22000 | 0x30c0 | 0x1600 | 2fe51a72ede820cd7cf55a77ba59b1f4 | False | 0.3126775568181818 | data | 3.2625868398009703 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x26000 | 0xc9a8 | 0xca00 | eb9f654f853dce6739134e3c685a0a4e | False | 0.9882038985148515 | data | 7.983132698598487 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_RCDATA | 0x26124 | 0xc43a | data | 1.0005175777361945 | ||
| RT_RCDATA | 0x32560 | 0x20 | data | 1.28125 | ||
| RT_VERSION | 0x32580 | 0x23c | data | 0.4772727272727273 | ||
| RT_MANIFEST | 0x327bc | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5469387755102041 |
| DLL | Import |
|---|---|
| KERNEL32.dll | RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA |
| ole32.dll | OleInitialize |
| OLEAUT32.dll | SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-10-09T12:18:16.237605+0200 | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.5 | 49704 | 176.126.114.74 | 36584 | TCP |
| 2024-10-09T12:20:53.704358+0200 | 2853193 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.5 | 49983 | 176.126.114.74 | 36584 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 9, 2024 12:18:03.813425064 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:03.819339991 CEST | 36584 | 49704 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:03.819442987 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:03.955197096 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:03.960098028 CEST | 36584 | 49704 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:16.237605095 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:16.242456913 CEST | 36584 | 49704 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:25.187426090 CEST | 36584 | 49704 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:25.187511921 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:29.063342094 CEST | 49704 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:29.064541101 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:29.068423033 CEST | 36584 | 49704 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:29.069550991 CEST | 36584 | 49802 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:29.069645882 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:29.118823051 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:29.123617887 CEST | 36584 | 49802 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:41.907552958 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:41.912707090 CEST | 36584 | 49802 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:50.457479000 CEST | 36584 | 49802 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:50.457678080 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:51.922679901 CEST | 49802 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:51.927021027 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:51.929281950 CEST | 36584 | 49802 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:51.933499098 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:18:51.933577061 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:51.964549065 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:18:51.971107960 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:02.001075029 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:02.007311106 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:12.047791958 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:12.054164886 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:12.329016924 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:12.333970070 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:13.427773952 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:13.427858114 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:18.047735929 CEST | 49939 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:18.053416014 CEST | 36584 | 49939 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:18.169599056 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:18.174585104 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:18.174664974 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:18.228444099 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:18.233555079 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:22.297796965 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:22.302978992 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:23.488986969 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:23.719327927 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:23.925853968 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:23.925869942 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:23.925909042 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:23.930882931 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:33.922750950 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:34.111730099 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:35.813493013 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:35.818408012 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:39.485702991 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:39.493792057 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:39.548161030 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:39.548223019 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:44.501013041 CEST | 49979 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:44.502733946 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:44.506349087 CEST | 36584 | 49979 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:44.508136988 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:44.508356094 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:44.641266108 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:44.646419048 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.516628981 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.521898985 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.688416004 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.693835974 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.750906944 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.755776882 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.766753912 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.771699905 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.813788891 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.818653107 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:19:55.954056025 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:19:55.958998919 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:03.875825882 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:03.880808115 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:05.894810915 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:05.894870043 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.126440048 CEST | 49980 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.128145933 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.131504059 CEST | 36584 | 49980 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:06.134838104 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:06.134975910 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.183533907 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.188714981 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:06.204263926 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.209207058 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:06.235235929 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.240309000 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:06.250823021 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:06.255937099 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:18.876041889 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:18.882059097 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:24.470010042 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:24.475142956 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:27.537622929 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:27.537733078 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:31.657330990 CEST | 49981 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:31.662379026 CEST | 36584 | 49981 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:31.777770996 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:31.782638073 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:31.782746077 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:31.838526011 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:31.843589067 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:32.219763994 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:32.224709988 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:35.766575098 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:35.771500111 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:37.594696999 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:37.601227999 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:37.610580921 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:37.616812944 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:42.865123034 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:42.870148897 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:47.938545942 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:47.943521023 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:47.954044104 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:47.958894968 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:47.985460997 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:47.990431070 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.000790119 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.005660057 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.016480923 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.021377087 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.063429117 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.068310022 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.078943968 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.083834887 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.094759941 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.099626064 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:48.110125065 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:48.114976883 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.159300089 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.159451962 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.172538996 CEST | 49982 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.176048994 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.177417040 CEST | 36584 | 49982 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.180977106 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.181188107 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.264051914 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.269062996 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.426101923 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.431518078 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.532160997 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.537148952 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.625978947 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.631218910 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.704358101 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.877058983 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.877132893 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.882010937 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:53.985492945 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:53.990648031 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:57.112159014 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:57.116954088 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.502123117 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.506967068 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.641571999 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.646470070 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.750976086 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.755963087 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.797951937 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.802896023 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.813711882 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.818531990 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.844938040 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.849891901 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.969646931 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.974672079 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:20:59.985414028 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:20:59.990413904 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.204068899 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.208980083 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.376180887 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.382316113 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.407601118 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.412410975 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.438471079 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.443351984 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.516988993 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.521981001 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.548024893 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.552880049 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:10.564264059 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:10.569242954 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:14.550195932 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:14.550390005 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.641484022 CEST | 49983 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.644016027 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.646358013 CEST | 36584 | 49983 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.648812056 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.648870945 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.703037977 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.707874060 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.735342026 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.740294933 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.750952959 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.755750895 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.922790051 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.927954912 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:15.938334942 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:15.943295956 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:26.188383102 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:26.193608999 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:26.250906944 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:26.255995989 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:26.438412905 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:26.443228006 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:26.454144001 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:26.459043980 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:26.500900984 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:26.505781889 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:31.891521931 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:31.896393061 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:31.938471079 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:31.944072008 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:32.032335043 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:32.038678885 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:32.047826052 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:32.054924011 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:32.063316107 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:32.069596052 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:37.056689978 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:37.060182095 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:37.130193949 CEST | 49984 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:37.138751984 CEST | 36584 | 49984 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:37.239428997 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:37.244311094 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:37.244429111 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:37.378854036 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:37.383935928 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:43.673132896 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:43.678550959 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:49.813513994 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:49.819830894 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:54.722451925 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:54.727377892 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:56.375855923 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Oct 9, 2024 12:21:56.417188883 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:58.629323006 CEST | 36584 | 49985 | 176.126.114.74 | 192.168.2.5 |
| Oct 9, 2024 12:21:58.629488945 CEST | 49985 | 36584 | 192.168.2.5 | 176.126.114.74 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Oct 9, 2024 12:18:03.665821075 CEST | 49249 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 9, 2024 12:18:03.797244072 CEST | 53 | 49249 | 1.1.1.1 | 192.168.2.5 |
| Oct 9, 2024 12:19:18.050582886 CEST | 51784 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 9, 2024 12:19:18.168535948 CEST | 53 | 51784 | 1.1.1.1 | 192.168.2.5 |
| Oct 9, 2024 12:20:31.659863949 CEST | 57537 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 9, 2024 12:20:31.776777029 CEST | 53 | 57537 | 1.1.1.1 | 192.168.2.5 |
| Oct 9, 2024 12:21:37.133369923 CEST | 56271 | 53 | 192.168.2.5 | 1.1.1.1 |
| Oct 9, 2024 12:21:37.238528967 CEST | 53 | 56271 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Oct 9, 2024 12:18:03.665821075 CEST | 192.168.2.5 | 1.1.1.1 | 0xc0df | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 9, 2024 12:19:18.050582886 CEST | 192.168.2.5 | 1.1.1.1 | 0xfe5e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 9, 2024 12:20:31.659863949 CEST | 192.168.2.5 | 1.1.1.1 | 0x7b6e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Oct 9, 2024 12:21:37.133369923 CEST | 192.168.2.5 | 1.1.1.1 | 0xd3af | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 9, 2024 12:18:03.797244072 CEST | 1.1.1.1 | 192.168.2.5 | 0xc0df | No error (0) | 176.126.114.74 | A (IP address) | IN (0x0001) | false | ||
| Oct 9, 2024 12:19:18.168535948 CEST | 1.1.1.1 | 192.168.2.5 | 0xfe5e | No error (0) | 176.126.114.74 | A (IP address) | IN (0x0001) | false | ||
| Oct 9, 2024 12:20:31.776777029 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 176.126.114.74 | A (IP address) | IN (0x0001) | false | ||
| Oct 9, 2024 12:21:37.238528967 CEST | 1.1.1.1 | 192.168.2.5 | 0xd3af | No error (0) | 176.126.114.74 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 06:17:54 |
| Start date: | 09/10/2024 |
| Path: | C:\Users\user\Desktop\8LNER6Tma8.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 190'976 bytes |
| MD5 hash: | F8ABE45FD211E5E97B75F741E12B3B52 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 7.7% |
| Dynamic/Decrypted Code Coverage: | 53% |
| Signature Coverage: | 13% |
| Total number of Nodes: | 347 |
| Total number of Limit Nodes: | 37 |
Graph
Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C745C0 Relevance: .3, Instructions: 281COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C74E90 Relevance: .3, Instructions: 266COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD0838 Relevance: 6.1, APIs: 4, Instructions: 135threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD0848 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05ADB130 Relevance: 1.8, APIs: 1, Instructions: 270COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD90A8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C77242 Relevance: 1.6, APIs: 1, Instructions: 132COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05ADB290 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05ADC23C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD0A88 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD0A90 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 022BAE38 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 022B91F0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C77328 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD92A8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 022B93C8 Relevance: 1.3, APIs: 1, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020AD610 Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020BD0FC Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020AD60B Relevance: .1, Instructions: 56COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020BD0F7 Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020AD006 Relevance: .0, Instructions: 47COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 020AD01D Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00408C60 Relevance: 4.1, Strings: 3, Instructions: 377COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C70040 Relevance: 1.9, APIs: 1, Instructions: 396COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 022B1020 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 022B1030 Relevance: 1.4, Strings: 1, Instructions: 142COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407C3F Relevance: .8, Instructions: 783COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004073A0 Relevance: .6, Instructions: 633COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD9790 Relevance: .5, Instructions: 521COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406CA0 Relevance: .4, Instructions: 401COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05AD7EB8 Relevance: .3, Instructions: 264COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05C74278 Relevance: .2, Instructions: 238COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402B90 Relevance: .2, Instructions: 212COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004028B0 Relevance: .2, Instructions: 184COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401650 Relevance: .1, Instructions: 111COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402F20 Relevance: .1, Instructions: 103COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402F89 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004146FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|