Edit tour

Windows Analysis Report
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Overview

General Information

Sample name:	17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe
Analysis ID:	1569854
MD5:	fa58afcb76508132cdd7aa5188b0dd8b
SHA1:	09318e1d9c42b50ceb31e589a235b425ff576956
SHA256:	551e1481dbb3127c56a805a38512a4767f93f3f309e2adb903120992a10f0819
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe (PID: 7748 cmdline: "C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe" MD5: FA58AFCB76508132CDD7AA5188B0DD8B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a34:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7be6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e2:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7834:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x78d1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x79e6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x74e2:$cnc4: POST / HTTP/1.1
00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe PID: 7748	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a34:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7be6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e2:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:51:36.589035+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:47.051103+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:53.002089+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:57.609124+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:08.051686+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:18.520284+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:23.027079+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:28.989048+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:30.600532+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:30.910924+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:38.256288+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:38.448012+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:42.457811+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:44.411837+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:53.017023+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:54.506058+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:56.583496+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:59.666190+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:59.857891+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:00.034346+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:10.466692+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.053915+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.245724+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.367915+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:13.863809+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:17.316524+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:20.139951+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.012335+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.207871+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:33.476831+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:33.669500+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:44.051895+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.615267+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.807201+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.929533+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:51.616959+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:52.914390+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:53.106178+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:00.816727+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:02.545204+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:13.004043+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:14.771057+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:15.804497+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:16.084595+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:20.864423+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.098726+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.290683+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.436864+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.524565+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:23.005881+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:24.458462+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:26.348709+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:36.817330+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:38.316806+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:45.040923+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:48.301723+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:52.939594+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.131320+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.265514+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:56.208541+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:06.416544+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:08.286919+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:08.478760+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:09.366068+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:11.989723+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:21.942434+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.012331+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.474269+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:28.004918+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:51:36.638514+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:51:47.053788+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:51:57.610928+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:08.055640+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:18.522057+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:29.020853+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:30.637596+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:30.916246+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:38.475196+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:38.595013+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:42.459902+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:44.416859+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:54.513020+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:56.585523+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:59.721361+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:59.859622+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:00.036274+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:10.468415+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.056114+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.247538+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.369696+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:13.866968+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:17.319625+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:20.141823+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:23.209313+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.479932+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.671637+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.794486+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.956599+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:44.062984+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.617479+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.809283+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.931346+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:51.620565+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:52.916339+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:00.818406+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:02.572765+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:13.006113+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:14.832195+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:15.811542+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:16.086509+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.116093+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.293685+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.442141+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.612113+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:24.460459+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:26.350834+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:36.820343+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:38.318985+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:45.046141+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:48.305086+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:52.953781+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:53.267660+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:56.213590+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:06.418776+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:08.292084+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:08.482726+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:09.370076+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:11.991474+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:21.944479+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:23.476285+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:28.005743+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:51:53.002089+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:23.027079+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:53.017023+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.012335+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:53.106178+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:23.005881+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.131320+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.012331+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.8	49704	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:52:59.273345+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.8	49704	87.120.116.179	1300	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: 87.120.116.179
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: 1300
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: <123456789>
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: DEIDARA
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	String decryptor: USB.exe

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49704 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 87.120.116.179:1300 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49704 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 87.120.116.179:1300 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49704 -> 87.120.116.179:1300

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.116.179

Source: global traffic

TCP traffic: 192.168.2.8:49704 -> 87.120.116.179:1300

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, 00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A74C2	0_2_00007FFB4B2A74C2
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A6716	0_2_00007FFB4B2A6716
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A2C38	0_2_00007FFB4B2A2C38

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, 00000000.00000000.1422145790.0000000000B0C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDEIDARA.exe4 vs 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Binary or memory string: OriginalFilenameDEIDARA.exe4 vs 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\JTzuMwKRwNYwE18T
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Mutant created: NULL

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A2E0B push eax; iretd	0_2_00007FFB4B2A2E49
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A2DF2 pushad ; retf	0_2_00007FFB4B2A2E09
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Code function: 0_2_00007FFB4B2A00BD pushad ; iretd	0_2_00007FFB4B2A00C1

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Memory allocated: F60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Memory allocated: 1AE30000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Window / User API: threadDelayed 9794

Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe TID: 7884	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe TID: 7888	Thread sleep count: 9794 > 30	Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe TID: 7888	Thread sleep count: 61 > 30	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, 00000000.00000002.3878731321.000000001BE70000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Queries volume information: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, 00000000.00000002.3878731321.000000001BEAA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe PID: 7748, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe PID: 7748, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	221 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	232 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	232 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	84%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	100%	Avira	TR/Spy.Gen
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
87.120.116.179	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
87.120.116.179	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe, 00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.116.179	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569854
Start date and time:	2024-12-06 10:50:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
04:51:24	API Interceptor	11785102x Sleep call for process: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.116.179	17334769266ba75a70859e94894e9fae5c33bba300e2b004c1166d236dc1ab2c8ff5669916631.dat-decoded.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	17334769266ba75a70859e94894e9fae5c33bba300e2b004c1166d236dc1ab2c8ff5669916631.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179
	yIla7SeJ6r.doc	Get hash	malicious	XenoRAT	Browse	87.120.120.27
	gjot5vxpIC.exe	Get hash	malicious	XenoRAT	Browse	87.120.120.27
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Stealc, Vidar	Browse	87.120.125.31
	po4877383.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	e824975.html	Get hash	malicious	Unknown	Browse	87.120.114.172
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	87.120.125.217
	RFQ LIST 767655776478637584637865763478634365634444444444444444453.exe	Get hash	malicious	GuLoader	Browse	87.120.114.159
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	87.120.114.159

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.612471249962789
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe
File size:	36'864 bytes
MD5:	fa58afcb76508132cdd7aa5188b0dd8b
SHA1:	09318e1d9c42b50ceb31e589a235b425ff576956
SHA256:	551e1481dbb3127c56a805a38512a4767f93f3f309e2adb903120992a10f0819
SHA512:	694028248e26e2c1fb3106ec6e101bca4e0b4e886d255376b04ce136d66459560dfd246df6b8d0eb945d907caa17c02db01816b6207f5d9c4c57e74d7aebf0f9
SSDEEP:	768:4L13A5Uno9RfHWa2B71eo8icH1bxbFb9EHUOMhmQXv0:GxA5Uno9JHWXZeNicH1bBFb9EHUOMs60
TLSH:	45F24C48BBE04216D9ED6BF5A97372020674E613D917EB4E4CE489D76F27BC08D013EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Eg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40a5ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6745C39F [Tue Nov 26 12:48:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa594	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85f4	0x8600	56276a7b84359c2f0d98b3b7e64ead33	False	0.49906716417910446	data	5.74750296465965	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4d8	0x600	0ddefdb4552e097a6fc90a039c8b2713	False	0.375	data	3.7352408382891036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	fd3ac7fbb8a34dc91e775b7c64e87bbc	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x244	data			0.47413793103448276
RT_MANIFEST	0xc2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T10:51:36.195498+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:51:36.589035+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:36.638514+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:51:47.051103+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:47.053788+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:51:53.002089+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:53.002089+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:57.609124+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:51:57.610928+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:08.051686+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:08.055640+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:18.520284+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:18.522057+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:23.027079+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:23.027079+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:28.989048+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:29.020853+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:30.600532+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:30.637596+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:30.910924+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:30.916246+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:38.256288+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:38.448012+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:38.475196+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:38.595013+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:42.457811+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:42.459902+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:44.411837+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:44.416859+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:53.017023+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:53.017023+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:54.506058+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:54.513020+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:56.583496+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:56.585523+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:59.273345+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:59.666190+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:59.721361+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:52:59.857891+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:52:59.859622+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:00.034346+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:00.036274+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:10.466692+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:10.468415+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.053915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.056114+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.245724+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.247538+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:12.367915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:12.369696+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:13.863809+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:13.866968+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:17.316524+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:17.319625+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:20.139951+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:20.141823+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:23.012335+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.012335+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.207871+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:23.209313+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.476831+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:33.479932+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.669500+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:33.671637+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.794486+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:33.956599+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:44.051895+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:44.062984+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.615267+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.617479+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.807201+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.809283+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:45.929533+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:45.931346+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:51.616959+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:51.620565+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:52.914390+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:52.916339+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:53:53.106178+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:53:53.106178+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:00.816727+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:00.818406+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:02.545204+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:02.572765+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:13.004043+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:13.006113+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:14.771057+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:14.832195+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:15.804497+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:15.811542+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:16.084595+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:16.086509+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:20.864423+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.098726+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.116093+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.290683+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.293685+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.436864+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.442141+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:21.524565+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:21.612113+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:23.005881+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:23.005881+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:24.458462+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:24.460459+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:26.348709+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:26.350834+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:36.817330+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:36.820343+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:38.316806+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:38.318985+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:45.040923+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:45.046141+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:48.301723+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:48.305086+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:52.939594+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:52.953781+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:53.131320+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.131320+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.265514+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:53.267660+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:54:56.208541+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:54:56.213590+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:06.416544+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:06.418776+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:08.286919+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:08.292084+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:08.478760+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:08.482726+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:09.366068+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:09.370076+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:11.989723+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:11.991474+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:21.942434+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:21.944479+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:23.012331+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.012331+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.474269+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:23.476285+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP
2024-12-06T10:55:28.004918+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.8	49704	TCP
2024-12-06T10:55:28.005743+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49704	87.120.116.179	1300	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:51:25.414753914 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:25.534811020 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:25.534976959 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:25.730209112 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:25.850003958 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:36.195497990 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:36.315330029 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:36.589035034 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:36.638514042 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:36.758404016 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:46.658097982 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:46.777885914 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:47.051103115 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:47.053787947 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:47.173568964 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:53.002089024 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:53.048491955 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:57.216109037 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:57.335899115 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:57.609123945 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:51:57.610928059 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:51:57.730820894 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:07.658165932 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:07.777920961 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:08.051686049 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:08.055639982 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:08.175362110 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:18.126965046 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:18.247303009 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:18.520283937 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:18.522057056 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:18.642000914 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:23.027079105 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:23.079813004 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:28.595789909 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:28.715821028 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:28.989048004 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:29.020853043 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:29.140657902 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.205533028 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:30.325323105 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.517575979 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:30.600532055 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.637521029 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.637595892 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:30.757536888 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.910923958 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:30.916245937 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:31.036145926 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:37.861624956 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:37.981513023 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:37.981656075 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:38.101421118 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:38.256288052 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:38.336272001 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:38.448012114 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:38.475195885 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:38.594943047 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:38.595012903 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:38.714806080 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:42.064687014 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:42.184452057 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:42.457811117 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:42.459902048 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:42.579619884 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:44.017996073 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:44.139708042 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:44.411837101 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:44.416858912 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:44.536886930 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:53.017023087 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:53.067322016 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:54.112422943 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:54.232141018 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:54.506057978 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:54.513020039 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:54.632832050 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:56.189919949 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:56.309763908 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:56.583496094 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:56.585522890 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:56.705328941 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.273344994 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:59.393155098 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.393441916 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:59.513154030 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.597364902 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:59.666189909 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.717189074 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.721360922 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:52:59.842221022 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.857891083 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:52:59.859622002 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:00.020468950 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:00.034346104 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:00.036273956 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:00.156161070 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:10.064754963 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:10.184437037 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:10.466691971 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:10.468415022 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:10.588185072 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:11.661604881 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:11.781407118 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:11.814749956 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:11.934604883 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:11.934652090 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:12.053915024 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.054296017 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.056113958 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:12.176062107 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.245723963 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.247538090 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:12.367389917 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.367914915 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:12.369695902 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:12.536572933 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:13.470972061 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:13.590831041 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:13.863809109 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:13.866967916 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:13.986706972 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:16.924153090 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:17.043899059 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:17.316524029 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:17.319624901 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:17.439362049 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:19.737469912 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:19.857297897 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:20.139950991 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:20.141823053 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:20.264058113 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:22.815371037 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:22.935198069 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:23.012335062 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:23.173902988 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:23.207870960 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:23.209312916 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:23.329179049 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.080667019 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:33.202951908 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.203012943 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:33.326252937 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.476830959 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.479932070 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:33.599754095 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.669500113 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.671637058 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:33.791441917 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.792303085 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.794486046 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:33.956480026 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:33.956598997 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:34.076440096 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:43.658607006 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:43.778439999 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:44.051894903 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:44.062983990 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:44.183296919 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.221330881 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:45.341169119 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.341219902 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:45.460954905 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.615267038 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.617479086 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:45.737435102 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.807200909 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.809283018 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:45.929131031 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.929533005 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:45.931345940 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:46.092578888 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:51.205872059 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:51.325728893 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:51.616959095 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:51.620564938 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:51.740303040 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:52.521641970 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:52.641514063 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:52.914390087 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:52.916338921 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:53:53.036153078 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:53.106178045 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:53:53.158421993 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:00.424470901 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:00.544176102 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:00.816726923 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:00.818406105 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:00.938213110 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:02.152252913 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:02.272162914 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:02.545203924 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:02.572765112 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:02.692536116 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:12.612042904 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:12.731812954 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:13.004043102 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:13.006113052 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:13.125926018 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:14.377661943 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:14.497426033 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:14.771056890 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:14.832195044 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:14.951961994 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:15.412081957 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:15.531920910 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:15.691806078 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:15.804497004 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:15.811480999 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:15.811542034 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:15.931482077 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:16.084594965 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:16.086508989 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:16.207295895 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:20.471470118 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:20.591238022 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:20.705996990 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:20.825911045 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:20.830723047 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:20.864423037 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:20.955678940 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:20.992527008 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:20.995966911 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:21.098726034 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.115988970 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.116092920 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:21.235984087 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.290683031 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.293684959 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:21.413573980 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.436863899 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.442141056 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:21.524564981 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.608967066 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:21.612112999 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:21.731986046 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:23.005881071 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:23.158632040 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:24.065169096 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:24.185395002 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:24.458462000 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:24.460458994 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:24.580172062 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:25.955687046 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:26.075551033 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:26.348709106 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:26.350833893 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:26.470566988 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:36.424837112 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:36.544800043 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:36.817329884 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:36.820343018 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:36.940226078 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:37.924709082 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:38.044709921 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:38.316806078 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:38.318984985 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:38.438735962 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:44.643381119 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:44.763484001 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:45.040923119 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:45.046140909 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:45.165848017 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:47.909224033 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:48.028892040 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:48.301723003 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:48.305085897 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:48.425580978 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:52.521961927 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:52.641783953 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:52.833957911 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:52.939594030 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:52.953707933 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:52.953780890 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:53.073420048 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:53.131320000 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:53.174413919 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:53.265513897 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:53.267659903 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:53.387516975 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:55.815598011 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:55.935286045 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:56.208540916 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:54:56.213589907 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:54:56.333334923 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:06.022047043 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:06.141766071 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:06.416543961 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:06.418776035 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:06.538706064 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:07.893856049 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:08.013576984 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.014116049 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:08.133912086 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.286919117 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.292083979 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:08.411767006 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.478760004 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.482726097 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:08.602436066 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:08.972184896 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:09.092015028 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:09.366067886 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:09.370075941 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:09.490508080 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:11.596973896 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:11.716797113 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:11.989722967 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:11.991473913 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:12.111188889 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:21.550057888 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:21.669897079 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:21.942434072 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:21.944478989 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:22.064249992 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:23.012331009 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:23.065185070 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:23.081188917 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:23.200851917 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:23.474268913 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:23.476284981 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:23.596092939 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:27.612418890 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:27.732264996 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:28.004918098 CET	1300	49704	87.120.116.179	192.168.2.8
Dec 6, 2024 10:55:28.005743027 CET	49704	1300	192.168.2.8	87.120.116.179
Dec 6, 2024 10:55:28.125844002 CET	1300	49704	87.120.116.179	192.168.2.8

Analysis Process: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exePID: 7748, Parent PID: 4084

General

Target ID:	0
Start time:	04:51:20
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe"
Imagebase:	0xb00000
File size:	36'864 bytes
MD5 hash:	FA58AFCB76508132CDD7AA5188B0DD8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1422131008.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3877099874.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exePID: 7748, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B2A2C38 Relevance: 2.4, Strings: 1, Instructions: 1140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFB4B2AB1A0

Memory Dump Source

Source File: 00000000.00000002.3879391505.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e36f3fbacafb7d9643e880e7252f43de0d28aaefeb74c11d58a3cb0f902954b5
Instruction ID: 3ac604153557f1ee80f8d113f2a951db68865348a1d5940968b3c2062d52f784
Opcode Fuzzy Hash: e36f3fbacafb7d9643e880e7252f43de0d28aaefeb74c11d58a3cb0f902954b5
Instruction Fuzzy Hash: BA725EB0B1C90A8FEB94FB38C55967A77D2EF9D311B508579D50EC32D2DE28AC428781

Function 00007FFB4B2A6716 Relevance: .5, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3879391505.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8146dfae5b2532f5c3c720d1b3e7333945728e57736db9fdda094500dd883dc
Instruction ID: 2b5e9b0dfc98ea2f853ee06410da141a6ee9bb4ce24baf9a5792ba471f4d4a24
Opcode Fuzzy Hash: b8146dfae5b2532f5c3c720d1b3e7333945728e57736db9fdda094500dd883dc
Instruction Fuzzy Hash: 21F1A67050CA8D8FEBA9EF28C8557E97BD1FF58311F04826AE84DC7291DF3899458B81

Function 00007FFB4B2A74C2 Relevance: .5, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3879391505.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a184fde661039cc708e83fb5e385dd482e6b8c4f3ca2d245660f491e601ed266
Instruction ID: 99e7501b22e87f807a52ac28f3fa920c1dab7d120a22247044d58fc39537fb0b
Opcode Fuzzy Hash: a184fde661039cc708e83fb5e385dd482e6b8c4f3ca2d245660f491e601ed266
Instruction Fuzzy Hash: CFE1C57050CA4D8FEBA9EF28C8557E97BD1FF58310F14826AD84DC72A1CF78A9418781

Function 00007FFB4B2A1BF8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFB4B2A1CC1

Memory Dump Source

Source File: 00000000.00000002.3879391505.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ec32107b52de6b3468e148b7f5b9dd3df432a248c35f0654c7dbbf35ce257659
Instruction ID: d3d41d0b210492a7b37e861ef3271bca4349cbed4f93f4d8a730f06fed2491ee
Opcode Fuzzy Hash: ec32107b52de6b3468e148b7f5b9dd3df432a248c35f0654c7dbbf35ce257659
Instruction Fuzzy Hash: 9641167090CA5C8FDB19EF68D8466F9BBE1EF5A321F00427ED049D3292CA64A852C781

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe

Function 00007FFB4B2A2C38 Relevance: 2.4, Strings: 1, Instructions: 1140
COMMON

Function 00007FFB4B2A6716 Relevance: .5, Instructions: 465
COMMON

Function 00007FFB4B2A74C2 Relevance: .5, Instructions: 451
COMMON

Function 00007FFB4B2A1BF8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON