Edit tour

Windows Analysis Report
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Overview

General Information

Sample name:	17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
Analysis ID:	1546912
MD5:	fb84f0c948174966776db1e4592fdc75
SHA1:	178b6ce2ddd9de88d5e6b39c212254b50d45cfd7
SHA256:	58e5f9caa04676b6269b870cc4aa3997287fd3a038d1df59e5bd2c41b75bbd62
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe (PID: 5224 cmdline: "C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe" MD5: FB84F0C948174966776DB1E4592FDC75)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["browser-hazard.gl.at.ply.gg"], "Port": "2620", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8140:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x81dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x82f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7dee:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\x-manager.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\x-manager.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8140:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x81dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x82f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7dee:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7f40:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7fdd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x80f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7bee:$cnc4: POST / HTTP/1.1
00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x9c00:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9c9d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9db2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x98ae:$cnc4: POST / HTTP/1.1
Process Memory Space: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe PID: 5224	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6340:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x63dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x64f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5fee:$cnc4: POST / HTTP/1.1
0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8140:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x81dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x82f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7dee:$cnc4: POST / HTTP/1.1
0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8140:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x81dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x82f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7dee:$cnc4: POST / HTTP/1.1
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, ProcessId: 5224, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T17:31:15.782631+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49731	TCP
2024-11-01T17:31:55.570005+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49742	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T17:33:14.873431+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	50014	147.185.221.23	2620	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\x-manager.exe

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["browser-hazard.gl.at.ply.gg"], "Port": "2620", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\x-manager.exe

ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\x-manager.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: browser-hazard.gl.at.ply.gg
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: 2620
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: <123456789>
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: XWorm V5.6
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: USB.exe
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: %AppData%
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	String decryptor: x-manager.exe

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49829 -> 147.185.221.23:2620
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:50014 -> 147.185.221.23:2620

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: browser-hazard.gl.at.ply.gg

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.185.221.23:2620

Source: Joe Sandbox View

IP Address: 147.185.221.23 147.185.221.23

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49742

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: browser-hazard.gl.at.ply.gg

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4107271743.0000000003041000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, XLogger.cs	.Net Code: KeyboardLayout
Source: x-manager.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\x-manager.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Code function: 0_2_00007FFD9B889762	0_2_00007FFD9B889762
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Code function: 0_2_00007FFD9B8889B6	0_2_00007FFD9B8889B6
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Code function: 0_2_00007FFD9B8805A8	0_2_00007FFD9B8805A8

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000000.1664100465.0000000000C5C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexworm.exe4 vs 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexworm.exe4 vs 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Binary or memory string: OriginalFilenamexworm.exe4 vs 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\x-manager.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x-manager.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x-manager.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: x-manager.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: x-manager.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: x-manager.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/3@1/1

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File created: C:\Users\user\AppData\Roaming\x-manager.exe

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\5fGznRuUj1JrT03R

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Jump to behavior

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File read: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: x-manager.lnk.0.dr

LNK file: ..\..\..\..\..\x-manager.exe

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: x-manager.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: x-manager.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, Messages.cs	.Net Code: Memory
Source: x-manager.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: x-manager.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: x-manager.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File created: C:\Users\user\AppData\Roaming\x-manager.exe

Jump to dropped file

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Memory allocated: 14B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Memory allocated: 1B040000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Window / User API: threadDelayed 5159			Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Window / User API: threadDelayed 4670			Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe TID: 2536

Thread sleep time: -3689348814741908s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4108549552.000000001BABF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Queries volume information: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4106566774.0000000001123000.00000004.00000020.00020000.00000000.sdmp, 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4108549552.000000001BAEA000.00000004.00000020.00020000.00000000.sdmp, 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4108549552.000000001BA60000.00000004.00000020.00020000.00000000.sdmp, 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4106566774.0000000001040000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\x-manager.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.13049ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\x-manager.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Masquerading	1 Input Capture	221 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	84%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	100%	Avira	TR/Spy.Gen
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\x-manager.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\x-manager.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\x-manager.exe	84%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
browser-hazard.gl.at.ply.gg	147.185.221.23	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
browser-hazard.gl.at.ply.gg	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe, 00000000.00000002.4107271743.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.23	browser-hazard.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546912
Start date and time:	2024-11-01 17:30:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/3@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
12:31:04	API Interceptor	13114924x Sleep call for process: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe modified
16:31:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.23	r8gcHFIf3x.exe	Get hash	malicious	XWorm	Browse
	0eVxwphG1t.exe	Get hash	malicious	XWorm	Browse
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse
	rustdesk.exe	Get hash	malicious	XWorm	Browse
	q0SpP6HxtE.exe	Get hash	malicious	XWorm	Browse
	mkDhqaw9dx.exe	Get hash	malicious	XWorm	Browse
	R7iHtCsOYz.exe	Get hash	malicious	XWorm	Browse
	Zvas34nq1T.exe	Get hash	malicious	XWorm	Browse
	fMdcaIZWzT.exe	Get hash	malicious	XWorm	Browse
	vtuLkV5KEW.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	r8gcHFIf3x.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	0eVxwphG1t.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	147.176.169.71
	rustdesk.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	Nurcraft.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	q0SpP6HxtE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	7bZWBYVNPU.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	mkDhqaw9dx.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	R7iHtCsOYz.exe	Get hash	malicious	XWorm	Browse	147.185.221.23

Process:	C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsra:EFYJKDoWra
MD5:	2C11513C4FAB02AEDEE23EC05A2EB3CC
SHA1:	59177C177B2546FBD8EC7688BAD19D08D32640DE
SHA-256:	BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
SHA-512:	08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	....### explorer ###..[WIN]r

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

Download File

Process:	C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 1 15:30:59 2024, mtime=Fri Nov 1 15:30:59 2024, atime=Fri Nov 1 15:30:59 2024, length=154624, window=hide
Category:	dropped
Size (bytes):	776
Entropy (8bit):	5.035356313092386
Encrypted:	false
SSDEEP:	12:8DWCI4wFiWCSgdY//s9klLxgmu8YZOjALrH/qX4idBmV:8KOW94+k9Q4JIALDqX4idBm
MD5:	C73ED24D6B6E83BDA634185D7FA7DB7F
SHA1:	8306605EB56F805EAE73D26CABF1988D7739F942
SHA-256:	33E940C884460F9C11F9B8FECBC820D14066A7E3D587B2DCE56F6BCE1DB6B65E
SHA-512:	4B18A9A05400774837761F00AE9A52CCC220C5C195C4E6CDE681CC6FFF415B6B971B272D22286CE17019BE0E5A762E12EA84D1AF4866C5BD31AAECD498FF21B1
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...U.Yo{,..U.Yo{,..U.Yo{,...\......................\|.:..DG..Yr?.D..U..k0.&...&......vk.v.....Nuh{,...6vo{,......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^aY............................%..A.p.p.D.a.t.a...B.V.1.....aY...Roaming.@......CW.^aY............................$..R.o.a.m.i.n.g.....h.2..\..aY.. .X-MANA~1.EXE..L......aY..aY................................x.-.m.a.n.a.g.e.r...e.x.e.......[...............-.......Z............556.....C:\Users\user\AppData\Roaming\x-manager.exe........\.....\.....\.....\.....\.x.-.m.a.n.a.g.e.r...e.x.e.`.......X.......562258...........hT..CrF.f4... .}T..b...,.......hT..CrF.f4... .}T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\x-manager.exe

Download File

Process:	C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154624
Entropy (8bit):	6.043231723341007
Encrypted:	false
SSDEEP:	3072:wxqxFiFO9W2OMJ4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvO:wxqiO9BgVqwlL
MD5:	FB84F0C948174966776DB1E4592FDC75
SHA1:	178B6CE2DDD9DE88D5E6B39C212254B50D45CFD7
SHA-256:	58E5F9CAA04676B6269B870CC4AA3997287FD3A038D1DF59E5BD2C41B75BBD62
SHA-512:	22874247132885D150E12D2E649690C296EF40EAA85F69CA90A9207CE1CE56C1FFEF488875936166F18E9F5FFB06AEB4A4FE6EDF01B0DCD9D6A64B43A6C36114
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\x-manager.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\x-manager.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Di.f............................n.... ........@.. ....................................@.....................................O.......T............................................................................ ............... ..H............text...t.... ...................... ..`.rsrc...T...........................@..@.reloc...............Z..............@..B................P.......H........W..$U............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.043231723341007
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
File size:	154'624 bytes
MD5:	fb84f0c948174966776db1e4592fdc75
SHA1:	178b6ce2ddd9de88d5e6b39c212254b50d45cfd7
SHA256:	58e5f9caa04676b6269b870cc4aa3997287fd3a038d1df59e5bd2c41b75bbd62
SHA512:	22874247132885d150e12d2e649690c296ef40eaa85f69ca90a9207ce1ce56c1ffef488875936166f18e9f5ffb06aeb4a4fe6edf01b0dcd9d6a64b43a6c36114
SSDEEP:	3072:wxqxFiFO9W2OMJ4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvO:wxqiO9BgVqwlL
TLSH:	4FE3A2698EEBB242C54A54747D7363824B395F79A4CF75158EE33FAE1BB3C9410230A2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Di.f............................n.... ........@.. ....................................@................................

File Icon


Icon Hash:	073149cccc490307

Static PE Info

General

Entrypoint:	0x40ad6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FD6944 [Wed Oct 2 15:39:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xad1c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x1c954	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8d74	0x8e00	5b79fcef0f076d0d5a575f4bb32d2841	False	0.49942231514084506	data	5.728970562657005	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x1c954	0x1ca00	692918a80109b1f62c5223d3b9869eb6	False	0.2493773881004367	data	5.818572371473846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a000	0xc	0x200	bad233d3fe1f2b72973dfc5b47cb596b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc220	0x3da8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9980993411049164
RT_ICON	0xffc8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.08706967940376198
RT_ICON	0x207f0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.16963863958431744
RT_ICON	0x24a18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.22697095435684647
RT_ICON	0x26fc0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3351313320825516
RT_ICON	0x28068	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.5904255319148937
RT_GROUP_ICON	0x284d0	0x5a	data	0.7222222222222222
RT_VERSION	0x2852c	0x23c	data	0.4755244755244755
RT_MANIFEST	0x28768	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T17:31:15.782631+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.4	49731	TCP
2024-11-01T17:31:55.570005+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49742	TCP
2024-11-01T17:32:16.498273+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49829	147.185.221.23	2620	TCP
2024-11-01T17:33:14.873431+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	50014	147.185.221.23	2620	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 17:31:05.635477066 CET	49730	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:05.661274910 CET	2620	49730	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:05.661437988 CET	49730	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:05.824670076 CET	49730	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:05.832432985 CET	2620	49730	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:14.215184927 CET	2620	49730	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:14.218547106 CET	49730	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:15.576144934 CET	49730	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:15.578242064 CET	49734	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:15.581207991 CET	2620	49730	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:15.583197117 CET	2620	49734	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:15.583295107 CET	49734	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:15.599679947 CET	49734	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:15.604648113 CET	2620	49734	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:24.076354980 CET	2620	49734	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:24.076499939 CET	49734	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:24.451054096 CET	49734	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:24.452722073 CET	49738	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:24.457771063 CET	2620	49734	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:24.458897114 CET	2620	49738	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:24.459012985 CET	49738	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:24.475404024 CET	49738	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:24.481153965 CET	2620	49738	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:33.253385067 CET	2620	49738	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:33.253638029 CET	2620	49738	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:33.254914045 CET	49738	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:34.279139042 CET	49738	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:34.280586958 CET	49739	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:34.291028976 CET	2620	49738	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:34.291049004 CET	2620	49739	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:34.291141033 CET	49739	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:34.306972980 CET	49739	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:34.313844919 CET	2620	49739	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:42.880857944 CET	2620	49739	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:42.880940914 CET	49739	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:43.654310942 CET	49739	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:43.655713081 CET	49740	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:43.661998987 CET	2620	49739	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:43.663775921 CET	2620	49740	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:43.663863897 CET	49740	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:43.679547071 CET	49740	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:43.685444117 CET	2620	49740	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:52.214306116 CET	2620	49740	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:52.214394093 CET	49740	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:53.466912985 CET	49740	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:53.469729900 CET	49741	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:53.473031044 CET	2620	49740	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:53.476950884 CET	2620	49741	147.185.221.23	192.168.2.4
Nov 1, 2024 17:31:53.477071047 CET	49741	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:53.494432926 CET	49741	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:31:53.499733925 CET	2620	49741	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:01.963056087 CET	2620	49741	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:01.963249922 CET	49741	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:02.421917915 CET	49741	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:02.423654079 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:02.429292917 CET	2620	49741	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:02.429800034 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:02.429872036 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:02.491641045 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:02.497397900 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:08.582895994 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:08.588037968 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:08.638978958 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:08.644252062 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:08.701416016 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:08.707484961 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:10.913734913 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:10.913819075 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:13.732347012 CET	49774	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:13.736793995 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:13.738483906 CET	2620	49774	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:13.742522001 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:13.748459101 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:13.889193058 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:13.894098043 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:16.498272896 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:16.503823996 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:16.513662100 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:16.518996954 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:22.235934019 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:22.236218929 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:23.951306105 CET	49829	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:23.952624083 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:23.956374884 CET	2620	49829	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:23.957797050 CET	2620	49886	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:23.957901001 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:23.994852066 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:23.999737978 CET	2620	49886	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:29.373290062 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:29.378815889 CET	2620	49886	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:32.449091911 CET	2620	49886	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:32.449142933 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:34.388685942 CET	49886	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:34.391273022 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:34.393634081 CET	2620	49886	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:34.396192074 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:34.396296024 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:34.503253937 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:34.508425951 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:35.420280933 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:35.425256014 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:35.467209101 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:35.472276926 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:41.435723066 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:41.440660000 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:41.466818094 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:41.471786976 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:42.404596090 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:42.409687042 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:42.467118979 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:42.472208977 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:42.592063904 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:42.596978903 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:42.904652119 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:42.904728889 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:46.763710022 CET	49943	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:46.766228914 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:46.769290924 CET	2620	49943	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:46.771446943 CET	2620	50006	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:46.771509886 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:46.803683043 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:46.808640957 CET	2620	50006	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:49.779444933 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:49.784514904 CET	2620	50006	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:55.248080015 CET	2620	50006	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:55.248155117 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:56.982477903 CET	50006	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:56.985363960 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:56.987581015 CET	2620	50006	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:56.990351915 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:56.990418911 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.026640892 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.032332897 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.032380104 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.037390947 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.123354912 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.128448009 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.139144897 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.144680977 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.170136929 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.175761938 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.217108011 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.222249985 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:32:57.248327971 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:32:57.253334045 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:05.479691982 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:05.479748011 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.504362106 CET	50013	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.511050940 CET	2620	50013	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:07.556372881 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.564420938 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:07.564595938 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.704787016 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.709718943 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:07.810766935 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.815728903 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:07.826237917 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:07.831993103 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:14.295212984 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:14.300740957 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:14.388873100 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:14.393877029 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:14.576560020 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:14.581613064 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:14.873430967 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:14.878808022 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:15.845565081 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:15.851907015 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:16.046715021 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:16.053662062 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:19.610584974 CET	50014	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:19.614017010 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:19.616295099 CET	2620	50014	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:19.619328976 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:19.619421005 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:19.837075949 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:19.843408108 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:20.201421022 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:20.214514971 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:28.338987112 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:28.339390993 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:28.342708111 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.263799906 CET	50015	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.267174959 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.268985987 CET	2620	50015	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:31.272295952 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:31.272356033 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.308617115 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.313631058 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:31.326415062 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.331418991 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:31.357609987 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:31.362431049 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:39.389141083 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:39.394843102 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:39.758621931 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:39.759249926 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.545097113 CET	50016	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.547735929 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.550690889 CET	2620	50016	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:41.552791119 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:41.552866936 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.588711977 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.594260931 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:41.890659094 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:41.895543098 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:44.608069897 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:44.613203049 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:50.032190084 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:50.032310009 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:52.343281031 CET	50017	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:52.344631910 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:52.348535061 CET	2620	50017	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:52.349668980 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:52.352871895 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:52.430679083 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:52.435734034 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:57.640818119 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:57.789681911 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:33:59.701502085 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:33:59.706943989 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:00.832019091 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:00.832103968 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.758465052 CET	50018	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.761826992 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.764250994 CET	2620	50018	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:02.767635107 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:02.767699003 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.809139967 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.814939022 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:02.858181953 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.863984108 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:02.889017105 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.894460917 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:02.935913086 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:02.943176031 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:11.264189959 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:11.264259100 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:14.186712980 CET	50019	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:14.188052893 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:14.192717075 CET	2620	50019	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:14.193476915 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:14.193640947 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:14.330702066 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:14.335778952 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:19.295289993 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:19.300534964 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:19.514450073 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:19.521728992 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:19.623493910 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:19.630290985 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:19.654890060 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:19.663518906 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:19.704814911 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:19.711474895 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:23.342518091 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:23.342583895 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:23.343091965 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:23.343133926 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:23.343159914 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:23.343189001 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.763907909 CET	50020	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.768826962 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.769215107 CET	2620	50020	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.774040937 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.774136066 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.809444904 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.814924002 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.826653004 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.833887100 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.842416048 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.847476959 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.920530081 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.925465107 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.951647043 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:24.957122087 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:24.998565912 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:25.004054070 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:25.014147043 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:25.019082069 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:33.267757893 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:33.267833948 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:35.061151981 CET	50021	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:35.062978029 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:35.066401958 CET	2620	50021	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:35.069068909 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:35.069346905 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:35.172178030 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:35.179960012 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:38.904629946 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:38.909679890 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.279906988 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.285207987 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.295253038 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.301474094 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.310930014 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.318079948 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.326483011 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.331841946 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.373437881 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.378348112 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.420275927 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.426070929 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.435844898 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.443576097 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.451445103 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.456458092 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.514007092 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.520230055 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.545202017 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.552844048 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.576519012 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.587944984 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.592134953 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.607914925 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:40.607980013 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:40.623020887 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:43.558231115 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:43.558296919 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.627214909 CET	50022	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.632642984 CET	2620	50022	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:45.694677114 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.699644089 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:45.704365969 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.820908070 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.826107979 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:45.967261076 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.972153902 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:45.982789993 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:45.987732887 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:46.170363903 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:46.175287008 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:46.201468945 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:46.206470966 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:51.279658079 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:51.284631968 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:54.187338114 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:54.187454939 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.623296022 CET	50023	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.628452063 CET	2620	50023	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:56.628489017 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.633416891 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:56.633605003 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.775607109 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.780932903 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:56.858128071 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.863315105 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:56.935892105 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.940990925 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:56.967082977 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:56.972870111 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:57.076507092 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:57.082726955 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:57.092350960 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:57.097394943 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:57.686577082 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:57.922655106 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:34:57.922738075 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:34:57.928939104 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:35:01.107830048 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:01.113015890 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:35:05.124253035 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:35:05.124326944 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:06.108619928 CET	50025	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:06.108617067 CET	50024	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:06.113920927 CET	2620	50025	147.185.221.23	192.168.2.4
Nov 1, 2024 17:35:06.113938093 CET	2620	50024	147.185.221.23	192.168.2.4
Nov 1, 2024 17:35:06.114131927 CET	50025	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:06.268313885 CET	50025	2620	192.168.2.4	147.185.221.23
Nov 1, 2024 17:35:06.273886919 CET	2620	50025	147.185.221.23	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 17:31:05.496584892 CET	63898	53	192.168.2.4	1.1.1.1
Nov 1, 2024 17:31:05.622852087 CET	53	63898	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 17:31:05.496584892 CET	192.168.2.4	1.1.1.1	0xb7d6	Standard query (0)	browser-hazard.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 17:31:05.622852087 CET	1.1.1.1	192.168.2.4	0xb7d6	No error (0)	browser-hazard.gl.at.ply.gg		147.185.221.23	A (IP address)	IN (0x0001)	false

Analysis Process: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exePID: 5224, Parent PID: 2580

General

Target ID:	0
Start time:	12:30:55
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe"
Imagebase:	0xc50000
File size:	154'624 bytes
MD5 hash:	FB84F0C948174966776DB1E4592FDC75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1664072674.0000000000C52000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.4108233558.0000000013048000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exePID: 5224, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	20.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8805A8 Relevance: 2.0, Strings: 1, Instructions: 716
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CAO_^, xrefs: 00007FFD9B880FF1

Memory Dump Source

Source File: 00000000.00000002.4109366724.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af67612922.jbxd

Similarity

API ID:
String ID: CAO_^
API String ID: 0-3111533842
Opcode ID: 3ac7834d607379049ebae022b5c56a4311dc38dddbcb7aa12da9a87a5e59eeef
Instruction ID: acff2d001eefb20c547e742205ea78c0c5619abd93bc407a481b8ab5ac7b8a40
Opcode Fuzzy Hash: 3ac7834d607379049ebae022b5c56a4311dc38dddbcb7aa12da9a87a5e59eeef
Instruction Fuzzy Hash: 08220920B29E494FE7A8FB788865AB977D2EF9C704F44007DE45DC32D6DE38A9418781

Function 00007FFD9B8889B6 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4109366724.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af67612922.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93352d3994c8dd454a0abc9848ee8b1b4eb3b25520a3133065e037ac5d24913
Instruction ID: bfe0d1d491e14ef2faac7a99055f9e245d6e1da8aba38e98b7bc74520757d1f6
Opcode Fuzzy Hash: a93352d3994c8dd454a0abc9848ee8b1b4eb3b25520a3133065e037ac5d24913
Instruction Fuzzy Hash: FBF1B830A09E4D8FEBA8DF28D8557E937D1FF58310F04426EE85DC72A5DB34A9458B82

Function 00007FFD9B889762 Relevance: .5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4109366724.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af67612922.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023237a13004678e9f19986a4a5445f4bc8c5b1a152368b36bc6bb072f6aaac8
Instruction ID: a0925277062244cff6b77ff899d397231f3e2ac0f4c06ef9ef944067d73dd9ab
Opcode Fuzzy Hash: 023237a13004678e9f19986a4a5445f4bc8c5b1a152368b36bc6bb072f6aaac8
Instruction Fuzzy Hash: 39E1E630A09A4E8FEBA8DF28C8557E977D1FF58310F04466ED85DC72A5CF74A9418B81

Function 00007FFD9B88227D Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD9B882352

Memory Dump Source

Source File: 00000000.00000002.4109366724.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af67612922.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 4f50b4b715c02cf28ebad9409d0e5fbcfbb9eaeaecb1ae07bb8473c44290a6c5
Instruction ID: a81e0b93d6b0d6a40a490ff45ce768bf008178b17bb28347e2b18ba83bc7ebd1
Opcode Fuzzy Hash: 4f50b4b715c02cf28ebad9409d0e5fbcfbb9eaeaecb1ae07bb8473c44290a6c5
Instruction Fuzzy Hash: 2C41033190C7588FDB18DFA8D855AE9BBF0FF5A310F04416EE09AC3692DB746846CB91

Function 00007FFD9B8827A8 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B882871

Memory Dump Source

Source File: 00000000.00000002.4109366724.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af67612922.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: aaf80e8d1b64cd2baf8f88d0905acc365cfc5c8f2915d220b02de6f9235d4414
Instruction ID: 2b7b11b4a626a4064bef4bd8b7126fa0cfa1f892f6ce95281be727aec2fe8f87
Opcode Fuzzy Hash: aaf80e8d1b64cd2baf8f88d0905acc365cfc5c8f2915d220b02de6f9235d4414
Instruction Fuzzy Hash: 94310A30A0CA4D4FDB5CEFAC98566F9BBE1EF59321F00027ED019C3292CA74A85287C1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Log.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x-manager.lnk

C:\Users\user\AppData\Roaming\x-manager.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe

Function 00007FFD9B8805A8 Relevance: 2.0, Strings: 1, Instructions: 716
COMMON

Function 00007FFD9B8889B6 Relevance: .5, Instructions: 472
COMMON

Function 00007FFD9B889762 Relevance: .5, Instructions: 457
COMMON

Function 00007FFD9B88227D Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Function 00007FFD9B8827A8 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON