Edit tour
Windows
Analysis Report
n7ZKbApaa3.dll
Overview
General Information
Sample name: | n7ZKbApaa3.dllrenamed because original name is a hash value |
Original sample name: | 0633330e8156219a811ac8e36dffb340c8843df3cc74036f746779f833327cd2.dll |
Analysis ID: | 1555757 |
MD5: | 26c9a2ed08569a57d6b33a1f884f6aa7 |
SHA1: | 02f05f0d48ddb7cfe071ddfd0740ed4c5c6e3cb7 |
SHA256: | 0633330e8156219a811ac8e36dffb340c8843df3cc74036f746779f833327cd2 |
Tags: | dllrepostebhu-sbsuser-JAMESWT_MHT |
Infos: | |
Detection
LummaC, Xmrig
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Drops password protected ZIP file
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Suspicious Execution of Powershell with Base64
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
- loaddll32.exe (PID: 8036 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\n7Z KbApaa3.dl l" MD5: 51E6071F9CBA48E79F10C84515AAE618) - conhost.exe (PID: 8052 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8136 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\n7Z KbApaa3.dl l",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - rundll32.exe (PID: 8160 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\n7ZK bApaa3.dll ",#1 MD5: 889B99C52A60DD49227C5E485A016679) - aspnet_regiis.exe (PID: 7232 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\asp net_regiis .exe" MD5: 5D1D74198D75640E889F0A577BBF31FC) - MPDIZKEMMIDUY52JFU3.exe (PID: 1272 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\MPDIZK EMMIDUY52J FU3.exe" MD5: CE901A874C9D157E48F83B1BE3D32AA6) - rundll32.exe (PID: 8144 cmdline:
rundll32.e xe C:\User s\user\Des ktop\n7ZKb Apaa3.dll, WindowsHan dle MD5: 889B99C52A60DD49227C5E485A016679) - aspnet_regiis.exe (PID: 7188 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\asp net_regiis .exe" MD5: 5D1D74198D75640E889F0A577BBF31FC) - OMUHDBFZQVAGPU7TP51CCEGFD7IXXU4.exe (PID: 1204 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\OMUHDB FZQVAGPU7T P51CCEGFD7 IXXU4.exe" MD5: CE901A874C9D157E48F83B1BE3D32AA6) - cmd.exe (PID: 2068 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\main \main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2180 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - mode.com (PID: 2732 cmdline:
mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875) - 7z.exe (PID: 3136 cmdline:
7z.exe e f ile.zip -p 2958664431 9935208542 739921766 -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 2972 cmdline:
7z.exe e e xtracted/f ile_11.zip -oextract ed MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 2924 cmdline:
7z.exe e e xtracted/f ile_10.zip -oextract ed MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 2356 cmdline:
7z.exe e e xtracted/f ile_9.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 4240 cmdline:
7z.exe e e xtracted/f ile_8.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 3844 cmdline:
7z.exe e e xtracted/f ile_7.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 5292 cmdline:
7z.exe e e xtracted/f ile_6.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 4056 cmdline:
7z.exe e e xtracted/f ile_5.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 4332 cmdline:
7z.exe e e xtracted/f ile_4.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 4460 cmdline:
7z.exe e e xtracted/f ile_3.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 3916 cmdline:
7z.exe e e xtracted/f ile_2.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - 7z.exe (PID: 5076 cmdline:
7z.exe e e xtracted/f ile_1.zip -oextracte d MD5: 619F7135621B50FD1900FF24AADE1524) - attrib.exe (PID: 4772 cmdline:
attrib +H "Installer .exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - Installer.exe (PID: 4952 cmdline:
"Installer .exe" MD5: 89A069871324D35E25922F6FB881D514) - RegSvcs.exe (PID: 6704 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Svcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94) - cmd.exe (PID: 1988 cmdline:
"cmd.exe" /C powersh ell -Encod edCommand "PAAjAEcAS gBpAFIAIwA +ACAAQQBkA GQALQBNAHA AUAByAGUAZ gBlAHIAZQB uAGMAZQAgA DwAIwBOAGI AIwA+ACAAL QBFAHgAYwB sAHUAcwBpA G8AbgBQAGE AdABoACAAQ AAoACQAZQB uAHYAOgBVA HMAZQByAFA AcgBvAGYAa QBsAGUALAA kAGUAbgB2A DoAUwB5AHM AdABlAG0AR AByAGkAdgB lACkAIAA8A CMAcAB2AGo AdgBZAFcAb QBPAEwAIwA +ACAALQBGA G8AcgBjAGU AIAA8ACMAN gBOAFoAMAA 4AGoAcABIA HYAbgAjAD4 A" & power cfg /x -hi bernate-ti meout-ac 0 & powercf g /x -hibe rnate-time out-dc 0 & powercfg /x -standb y-timeout- ac 0 & pow ercfg /x - standby-ti meout-dc 0 & powercf g /hiberna te off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 5916 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 4556 cmdline:
powershell -EncodedC ommand "PA AjAEcASgBp AFIAIwA+AC AAQQBkAGQA LQBNAHAAUA ByAGUAZgBl AHIAZQBuAG MAZQAgADwA IwBOAGIAIw A+ACAALQBF AHgAYwBsAH UAcwBpAG8A bgBQAGEAdA BoACAAQAAo ACQAZQBuAH YAOgBVAHMA ZQByAFAAcg BvAGYAaQBs AGUALAAkAG UAbgB2ADoA UwB5AHMAdA BlAG0ARABy AGkAdgBlAC kAIAA8ACMA cAB2AGoAdg BZAFcAbQBP AEwAIwA+AC AALQBGAG8A cgBjAGUAIA A8ACMANgBO AFoAMAA4AG oAcABIAHYA bgAjAD4A" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - WmiPrvSE.exe (PID: 4100 cmdline:
C:\Windows \system32\ wbem\wmipr vse.exe -s ecured -Em bedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51) - powercfg.exe (PID: 5288 cmdline:
powercfg / x -hiberna te-timeout -ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05) - powercfg.exe (PID: 3936 cmdline:
powercfg / x -hiberna te-timeout -dc 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05) - powercfg.exe (PID: 4272 cmdline:
powercfg / x -standby -timeout-a c 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05) - powercfg.exe (PID: 2836 cmdline:
powercfg / x -standby -timeout-d c 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05) - powercfg.exe (PID: 8172 cmdline:
powercfg / hibernate off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05) - cmd.exe (PID: 8156 cmdline:
"cmd.exe" /c SCHTASK S /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\P rogramData \Dllhost\d llhost.exe " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 1472 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 8116 cmdline:
SCHTASKS / CREATE /SC MINUTE /M O 5 /TN "d llhost" /T R "C:\Prog ramData\Dl lhost\dllh ost.exe" MD5: 48C2FE20575769DE916F48EF0676A965) - cmd.exe (PID: 8028 cmdline:
"cmd.exe" /c SCHTASK S /CREATE /SC HOURLY /TN "NvSt ray\NvStra yService_b k4013" /TR "C:\Progr amData\Dll host\dllho st.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6840 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 8068 cmdline:
SCHTASKS / CREATE /SC HOURLY /T N "NvStray \NvStraySe rvice_bk40 13" /TR "C :\ProgramD ata\Dllhos t\dllhost. exe" MD5: 48C2FE20575769DE916F48EF0676A965) - rundll32.exe (PID: 6472 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\n7ZK bApaa3.dll ",WindowsH andle MD5: 889B99C52A60DD49227C5E485A016679) - aspnet_regiis.exe (PID: 6080 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\asp net_regiis .exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
xmrig | According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. | No Attribution |
{"C2 url": ["thinkyyokej.sbs", "explainvees.sbs", "tamedgeesy.sbs", "rottieud.sbs", "ducksringjk.sbs", "brownieyuz.sbs", "repostebhu.sbs", "relalingj.sbs", "pragapin.sbs"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
Click to see the 67 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security |
System Summary |
---|
Source: | Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Persistence and Installation Behavior |
---|
Source: | Author: Joe Security: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:29.461435+0100 | 2022930 | 1 | A Network Trojan was detected | 172.202.163.200 | 443 | 192.168.2.10 | 49789 | TCP |
2024-11-14T12:20:09.185130+0100 | 2022930 | 1 | A Network Trojan was detected | 172.202.163.200 | 443 | 192.168.2.10 | 49992 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:28.099910+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49794 | 104.102.49.254 | 443 | TCP |
2024-11-14T12:19:28.101526+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49793 | 104.102.49.254 | 443 | TCP |
2024-11-14T12:19:29.656887+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49802 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:29.659001+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49803 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:30.960384+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49814 | 104.102.49.254 | 443 | TCP |
2024-11-14T12:19:31.478233+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49816 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:31.496127+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49818 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:34.410278+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49835 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:34.941754+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49839 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:40.521903+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49867 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:43.416747+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49883 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:43.482312+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49887 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:46.363351+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49903 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:46.838915+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49904 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:48.321902+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49914 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:48.386896+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49915 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:50.115623+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49926 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:51.951371+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49934 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:53.708804+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.10 | 49945 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:30.762640+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49803 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:30.795891+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49802 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:33.432190+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49818 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:33.436165+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49816 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:56.158833+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49934 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:56.158971+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.10 | 49945 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:30.762640+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.10 | 49803 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:30.795891+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.10 | 49802 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:33.432190+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.10 | 49818 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:33.436165+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.10 | 49816 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:29.656887+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49802 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:29.659001+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49803 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:31.478233+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49816 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:31.496127+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49818 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:34.410278+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49835 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:34.941754+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49839 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:40.521903+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49867 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:43.416747+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49883 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:43.482312+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49887 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:46.363351+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49903 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:46.838915+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49904 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:48.321902+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49914 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:48.386896+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49915 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:50.115623+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49926 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:51.951371+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49934 | 188.114.97.3 | 443 | TCP |
2024-11-14T12:19:53.708804+0100 | 2057416 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49945 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.129637+0100 | 2057334 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 52884 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.080611+0100 | 2057338 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 52620 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.105185+0100 | 2057340 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 62049 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:28.860579+0100 | 2057415 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 57028 | 1.1.1.1 | 53 | UDP |
2024-11-14T12:19:42.869997+0100 | 2057415 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 63519 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:26.943414+0100 | 2057360 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 59435 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.180272+0100 | 2057344 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 55336 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.021061+0100 | 2057346 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 54003 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.155239+0100 | 2057348 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 52947 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.206024+0100 | 2057350 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 53617 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:27.048602+0100 | 2057354 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 55082 | 1.1.1.1 | 53 | UDP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:48.814861+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.10 | 49914 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:20:17.515654+0100 | 2829056 | 2 | Crypto Currency Mining Activity Detected | 192.168.2.10 | 49995 | 147.45.47.81 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-11-14T12:19:28.728959+0100 | 2858666 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49794 | 104.102.49.254 | 443 | TCP |
2024-11-14T12:19:28.744377+0100 | 2858666 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49793 | 104.102.49.254 | 443 | TCP |
2024-11-14T12:19:31.561533+0100 | 2858666 | 1 | Domain Observed Used for C2 Detected | 192.168.2.10 | 49814 | 104.102.49.254 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: |
Source: | Code function: | 8_2_77075889 |
Bitcoin Miner |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Code function: | 8_2_7709C7E0 | |
Source: | Code function: | 8_2_7706B620 | |
Source: | Code function: | 8_2_77086C5A | |
Source: | Code function: | 8_2_7709CC90 | |
Source: | Code function: | 8_2_77098CAB | |
Source: | Code function: | 8_2_7706A282 | |
Source: | Code function: | 8_2_77080AE1 | |
Source: | Code function: | 8_2_7707E110 | |
Source: | Code function: | 8_2_7707E110 | |
Source: | Code function: | 8_2_77062170 | |
Source: | Code function: | 8_2_770989A6 | |
Source: | Code function: | 8_2_77081702 | |
Source: | Code function: | 8_2_77085710 | |
Source: | Code function: | 8_2_7706CF31 | |
Source: | Code function: | 8_2_77081F60 | |
Source: | Code function: | 8_2_77081F60 | |
Source: | Code function: | 8_2_77084767 | |
Source: | Code function: | 8_2_7707E778 | |
Source: | Code function: | 8_2_7707E778 | |
Source: | Code function: | 8_2_7709B7A0 | |
Source: | Code function: | 8_2_7709BFA0 | |
Source: | Code function: | 8_2_77081600 | |
Source: | Code function: | 8_2_77081600 | |
Source: | Code function: | 8_2_7709A610 | |
Source: | Code function: | 8_2_7707CE30 | |
Source: | Code function: | 8_2_77085E50 | |
Source: | Code function: | 8_2_7709AEA0 | |
Source: | Code function: | 8_2_7709AEA0 | |
Source: | Code function: | 8_2_770676C0 | |
Source: | Code function: | 8_2_770986FF | |
Source: | Code function: | 8_2_770816F6 | |
Source: | Code function: | 8_2_77069510 | |
Source: | Code function: | 8_2_77081D44 | |
Source: | Code function: | 8_2_7707755A | |
Source: | Code function: | 8_2_7707755A | |
Source: | Code function: | 8_2_77095586 | |
Source: | Code function: | 8_2_770805A0 | |
Source: | Code function: | 8_2_770795D0 | |
Source: | Code function: | 8_2_7707FC1B | |
Source: | Code function: | 8_2_7707FC1B | |
Source: | Code function: | 8_2_7707FC1B | |
Source: | Code function: | 8_2_7707BC30 | |
Source: | Code function: | 8_2_77090480 | |
Source: | Code function: | 8_2_77083490 | |
Source: | Code function: | 8_2_7709BCB0 | |
Source: | Code function: | 8_2_77073CC0 | |
Source: | Code function: | 8_2_77073CC0 | |
Source: | Code function: | 8_2_77084CDE | |
Source: | Code function: | 8_2_7709D310 | |
Source: | Code function: | 8_2_7709D310 | |
Source: | Code function: | 8_2_7706D321 | |
Source: | Code function: | 8_2_77096B20 | |
Source: | Code function: | 8_2_7706A34C | |
Source: | Code function: | 8_2_77065B70 | |
Source: | Code function: | 8_2_77065B70 | |
Source: | Code function: | 8_2_77098B93 | |
Source: | Code function: | 8_2_77096230 | |
Source: | Code function: | 8_2_77074249 | |
Source: | Code function: | 8_2_77087A82 | |
Source: | Code function: | 8_2_7709BAE0 | |
Source: | Code function: | 8_2_77074914 | |
Source: | Code function: | 8_2_77076940 | |
Source: | Code function: | 8_2_77083160 | |
Source: | Code function: | 8_2_77085170 | |
Source: | Code function: | 8_2_770770F6 | |
Source: | Code function: | 8_2_770879B5 | |
Source: | Code function: | 8_2_770881E3 | |
Source: | Code function: | 8_2_77084017 | |
Source: | Code function: | 8_2_77080040 | |
Source: | Code function: | 8_2_7709D040 | |
Source: | Code function: | 8_2_7709D040 | |
Source: | Code function: | 8_2_7707D090 | |
Source: | Code function: | 8_2_7707D090 | |
Source: | Code function: | 8_2_770808EC | |
Source: | Code function: | 8_2_770778EF | |
Source: | Code function: | 8_2_770770F6 | |
Source: | Code function: | 10_2_7706B620 | |
Source: | Code function: | 10_2_77098CAB | |
Source: | Code function: | 10_2_7706A282 | |
Source: | Code function: | 10_2_770989A6 | |
Source: | Code function: | 10_2_77081702 | |
Source: | Code function: | 10_2_77085710 | |
Source: | Code function: | 10_2_7706CF31 | |
Source: | Code function: | 10_2_77081F60 | |
Source: | Code function: | 10_2_77081F60 | |
Source: | Code function: | 10_2_77084767 | |
Source: | Code function: | 10_2_7707E778 | |
Source: | Code function: | 10_2_7707E778 | |
Source: | Code function: | 10_2_7709B7A0 | |
Source: | Code function: | 10_2_7709BFA0 | |
Source: | Code function: | 10_2_7709C7E0 | |
Source: | Code function: | 10_2_77081600 | |
Source: | Code function: | 10_2_77081600 | |
Source: | Code function: | 10_2_7709A610 | |
Source: | Code function: | 10_2_7707CE30 | |
Source: | Code function: | 10_2_77085E50 | |
Source: | Code function: | 10_2_7709AEA0 | |
Source: | Code function: | 10_2_7709AEA0 | |
Source: | Code function: | 10_2_770676C0 | |
Source: | Code function: | 10_2_770986FF | |
Source: | Code function: | 10_2_770816F6 | |
Source: | Code function: | 10_2_77069510 | |
Source: | Code function: | 10_2_77081D44 | |
Source: | Code function: | 10_2_7707755A | |
Source: | Code function: | 10_2_7707755A | |
Source: | Code function: | 10_2_77095586 | |
Source: | Code function: | 10_2_770805A0 | |
Source: | Code function: | 10_2_770795D0 | |
Source: | Code function: | 10_2_7707FC1B | |
Source: | Code function: | 10_2_7707FC1B | |
Source: | Code function: | 10_2_7707FC1B | |
Source: | Code function: | 10_2_7707BC30 | |
Source: | Code function: | 10_2_77086C5A | |
Source: | Code function: | 10_2_77090480 | |
Source: | Code function: | 10_2_77083490 | |
Source: | Code function: | 10_2_7709CC90 | |
Source: | Code function: | 10_2_7709BCB0 | |
Source: | Code function: | 10_2_77073CC0 | |
Source: | Code function: | 10_2_77073CC0 | |
Source: | Code function: | 10_2_77084CDE | |
Source: | Code function: | 10_2_7709D310 | |
Source: | Code function: | 10_2_7709D310 | |
Source: | Code function: | 10_2_7706D321 | |
Source: | Code function: | 10_2_77096B20 | |
Source: | Code function: | 10_2_7706A34C | |
Source: | Code function: | 10_2_77065B70 | |
Source: | Code function: | 10_2_77065B70 | |
Source: | Code function: | 10_2_77098B93 | |
Source: | Code function: | 10_2_77096230 | |
Source: | Code function: | 10_2_77074249 | |
Source: | Code function: | 10_2_77087A82 | |
Source: | Code function: | 10_2_77080AE1 | |
Source: | Code function: | 10_2_7709BAE0 | |
Source: | Code function: | 10_2_77074914 | |
Source: | Code function: | 10_2_7707E110 | |
Source: | Code function: | 10_2_7707E110 | |
Source: | Code function: | 10_2_77076940 | |
Source: | Code function: | 10_2_77083160 | |
Source: | Code function: | 10_2_77062170 | |
Source: | Code function: | 10_2_77085170 | |
Source: | Code function: | 10_2_770770F6 | |
Source: | Code function: | 10_2_770879B5 | |
Source: | Code function: | 10_2_770881E3 | |
Source: | Code function: | 10_2_77084017 | |
Source: | Code function: | 10_2_77080040 | |
Source: | Code function: | 10_2_7709D040 | |
Source: | Code function: | 10_2_7709D040 | |
Source: | Code function: | 10_2_7707D090 | |
Source: | Code function: | 10_2_7707D090 | |
Source: | Code function: | 10_2_770808EC | |
Source: | Code function: | 10_2_770778EF | |
Source: | Code function: | 10_2_770770F6 |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: |
Source: | DNS query: |
Source: | HTTP traffic detected: |