Edit tour
Windows
Analysis Report
l3v0.exe
Overview
General Information
| Sample name: | l3v0.exe |
| Analysis ID: | 1583741 |
| MD5: | bce921da7e4ed6138b0d5cb30952a855 |
| SHA1: | b27ea9e52e550ea081da249925af52f0c92f420e |
| SHA256: | 6def8cb28331b9b23f7c2601fc55efe8008a4d88c04286b48db42b673c0ab8e8 |
| Tags: | exemalwaretrojanuser-Joker |
| Infos: | |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
May sleep (evasive loops) to hinder dynamic analysis
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Classification
- System is w10x64
l3v0.exe (PID: 824 cmdline: "C:\Users\ user\Deskt op\l3v0.ex e" MD5: BCE921DA7E4ED6138B0D5CB30952A855) 
conhost.exe (PID: 1740 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | DNS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00007FF681C31A68 | |
| Source: | Code function: | 0_2_00007FF681C31C0C | |
| Source: | Code function: | 0_2_00007FF681C31584 | |
| Source: | Code function: | 0_2_00007FF681C31A68 | |
| Source: | Code function: | 0_2_00007FF681C31940 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Virtualization/Sandbox Evasion | OS Credential Dumping | 1 System Time Discovery | Remote Services | Data from Local System | 1 Non-Standard Port | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Process Injection | LSASS Memory | 11 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 1 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | Binary Padding | NTDS | 2 System Information Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 28% | Virustotal | Browse | ||
| 13% | ReversingLabs | Win64.Trojan.Bodegun | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| 198.187.3.20.in-addr.arpa | unknown | unknown | false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 3.107.255.174 | unknown | United States | 16509 | AMAZON-02US | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1583741 |
| Start date and time: | 2025-01-03 13:52:05 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 3m 45s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | l3v0.exe |
| Detection: | MAL |
| Classification: | mal56.winEXE@2/0@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 52.149.20.212, 20.3.187.198, 13.107.246.45
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
⊘No simulations
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| AMAZON-02US | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Gafgyt, Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 4.940690500527577 |
| TrID: |
|
| File name: | l3v0.exe |
| File size: | 12'288 bytes |
| MD5: | bce921da7e4ed6138b0d5cb30952a855 |
| SHA1: | b27ea9e52e550ea081da249925af52f0c92f420e |
| SHA256: | 6def8cb28331b9b23f7c2601fc55efe8008a4d88c04286b48db42b673c0ab8e8 |
| SHA512: | 60cbc04edf86d0c5668e0e92e21e1c420c1307f919e3ddf84e96a0be7455386bee3d47fed20dfd1b569428e0bad1acfeccb792d60d8bddbf67eb57faa08ec975 |
| SSDEEP: | 192:GidoRJHb9Ee/je1v2kN5Bc9r8RsQ5tfZc3:pSPHb9EsjOH5Bi8Rs |
| TLSH: | 36421947BF938DE8DA248170C4331E1AF2BBB7309762538F877455221E66390BCA76C9 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........g...4...4...4..K4...4.O.5...4.O.5...4.O.5...4.O.5...4...5...4...4...4.O.5...4.O'4...4.O.5...4Rich...4........PE..d.....wg... |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x140001570 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x6777A519 [Fri Jan 3 08:51:37 2025 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | b88f4cd742ae7c77b018b6db1bbdb1ee |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007FD47483400Ch |
| dec eax |
| add esp, 28h |
| jmp 00007FD474833AB7h |
| int3 |
| int3 |
| inc eax |
| push ebx |
| dec eax |
| sub esp, 20h |
| dec eax |
| mov ebx, ecx |
| xor ecx, ecx |
| call dword ptr [00001AEBh] |
| dec eax |
| mov ecx, ebx |
| call dword ptr [00001ADAh] |
| call dword ptr [00001AE4h] |
| dec eax |
| mov ecx, eax |
| mov edx, C0000409h |
| dec eax |
| add esp, 20h |
| pop ebx |
| dec eax |
| jmp dword ptr [00001AD8h] |
| dec eax |
| mov dword ptr [esp+08h], ecx |
| dec eax |
| sub esp, 38h |
| mov ecx, 00000017h |
| call dword ptr [00001A9Ch] |
| test eax, eax |
| je 00007FD474833C49h |
| mov ecx, 00000002h |
| int 29h |
| dec eax |
| lea ecx, dword ptr [00003B42h] |
| call 00007FD474833CEEh |
| dec eax |
| mov eax, dword ptr [esp+38h] |
| dec eax |
| mov dword ptr [00003C29h], eax |
| dec eax |
| lea eax, dword ptr [esp+38h] |
| dec eax |
| add eax, 08h |
| dec eax |
| mov dword ptr [00003BB9h], eax |
| dec eax |
| mov eax, dword ptr [00003C12h] |
| dec eax |
| mov dword ptr [00003A83h], eax |
| dec eax |
| mov eax, dword ptr [esp+40h] |
| dec eax |
| mov dword ptr [00003B87h], eax |
| mov dword ptr [00003A5Dh], C0000409h |
| mov dword ptr [00003A57h], 00000001h |
| mov dword ptr [00003A61h], 00000001h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x399c | 0xc8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x7000 | 0x1e0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x6000 | 0x18c | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x8000 | 0x30 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x3430 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x32f0 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x3000 | 0x210 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x116c | 0x1200 | 8796910620abae1cffc661b1f7751b10 | False | 0.6319444444444444 | zlib compressed data | 5.995569507650531 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x3000 | 0x1156 | 0x1200 | 249a3856dfc8d01c4210ff2deb375253 | False | 0.3756510416666667 | data | 4.086782622111068 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x5000 | 0x680 | 0x200 | 85c2aebd011c5c1b37c1009def59c2b6 | False | 0.09375 | data | 0.5324895658143383 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x6000 | 0x18c | 0x200 | 2aeb3a18d6719554eeeabb81e3ce9d8d | False | 0.46875 | data | 3.0681451707792435 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x7000 | 0x1e0 | 0x200 | 0b35de07beeb30d1d6013cbca2846303 | False | 0.525390625 | data | 4.701503258251789 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x8000 | 0x30 | 0x200 | 4c504a645248480104d353b6053f5847 | False | 0.12109375 | data | 0.7101928893219522 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x7060 | 0x17d | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5931758530183727 |
| DLL | Import |
|---|---|
| KERNEL32.dll | WaitForSingleObject, Sleep, CloseHandle, FreeConsole, CreateProcessW, RtlLookupFunctionEntry, GetModuleHandleW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, IsProcessorFeaturePresent, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, RtlCaptureContext |
| WS2_32.dll | WSASocketW, closesocket, WSACleanup, htons, WSAConnect, inet_pton, WSAStartup, recv |
| VCRUNTIME140.dll | __C_specific_handler, __current_exception, __current_exception_context, memset, memcpy |
| api-ms-win-crt-runtime-l1-1-0.dll | _register_onexit_function, _register_thread_local_exe_atexit_callback, _get_initial_narrow_environment, _crt_atexit, _c_exit, _configure_narrow_argv, _initialize_onexit_table, _set_app_type, _seh_filter_exe, _initialize_narrow_environment, exit, __p___argv, __p___argc, _exit, _initterm_e, _initterm, terminate, _cexit |
| api-ms-win-crt-convert-l1-1-0.dll | atoi |
| api-ms-win-crt-math-l1-1-0.dll | __setusermatherr |
| api-ms-win-crt-stdio-l1-1-0.dll | _set_fmode, __p__commode |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale |
| api-ms-win-crt-heap-l1-1-0.dll | _set_new_mode |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 3, 2025 13:53:03.744533062 CET | 49730 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:03.749396086 CET | 4953 | 49730 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:03.749474049 CET | 49730 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:05.761142969 CET | 4953 | 49730 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:05.761272907 CET | 49730 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:05.761504889 CET | 49730 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:05.766225100 CET | 4953 | 49730 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:10.772028923 CET | 49731 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:10.777878046 CET | 4953 | 49731 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:10.777956963 CET | 49731 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:12.795948029 CET | 4953 | 49731 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:12.796037912 CET | 49731 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:12.796092033 CET | 49731 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:12.800843954 CET | 4953 | 49731 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:17.803611994 CET | 49734 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:17.808459997 CET | 4953 | 49734 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:17.808537960 CET | 49734 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:19.806934118 CET | 4953 | 49734 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:19.807028055 CET | 49734 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:19.807077885 CET | 49734 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:19.811916113 CET | 4953 | 49734 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:24.819094896 CET | 49739 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:24.824058056 CET | 4953 | 49739 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:24.824172974 CET | 49739 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:26.824258089 CET | 4953 | 49739 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:26.824362993 CET | 49739 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:26.824470043 CET | 49739 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:26.829298973 CET | 4953 | 49739 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:31.834914923 CET | 49740 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:31.839870930 CET | 4953 | 49740 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:31.839951038 CET | 49740 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:31.946157932 CET | 53573 | 53 | 192.168.2.4 | 162.159.36.2 |
| Jan 3, 2025 13:53:31.950931072 CET | 53 | 53573 | 162.159.36.2 | 192.168.2.4 |
| Jan 3, 2025 13:53:31.950990915 CET | 53573 | 53 | 192.168.2.4 | 162.159.36.2 |
| Jan 3, 2025 13:53:31.955751896 CET | 53 | 53573 | 162.159.36.2 | 192.168.2.4 |
| Jan 3, 2025 13:53:32.432889938 CET | 53573 | 53 | 192.168.2.4 | 162.159.36.2 |
| Jan 3, 2025 13:53:32.438148022 CET | 53 | 53573 | 162.159.36.2 | 192.168.2.4 |
| Jan 3, 2025 13:53:32.438194990 CET | 53573 | 53 | 192.168.2.4 | 162.159.36.2 |
| Jan 3, 2025 13:53:33.821783066 CET | 4953 | 49740 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:33.821886063 CET | 49740 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:33.821922064 CET | 49740 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:33.826719999 CET | 4953 | 49740 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:38.834136009 CET | 53578 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:38.839006901 CET | 4953 | 53578 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:38.839081049 CET | 53578 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:40.843492985 CET | 4953 | 53578 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:40.843693018 CET | 53578 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:40.843751907 CET | 53578 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:40.848485947 CET | 4953 | 53578 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:45.849772930 CET | 53579 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:45.859137058 CET | 4953 | 53579 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:45.859230995 CET | 53579 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:47.853161097 CET | 4953 | 53579 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:47.853256941 CET | 53579 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:47.853404999 CET | 53579 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:47.858134031 CET | 4953 | 53579 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:52.865583897 CET | 53580 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:52.870547056 CET | 4953 | 53580 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:52.870619059 CET | 53580 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:54.870506048 CET | 4953 | 53580 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:54.870585918 CET | 53580 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:54.870632887 CET | 53580 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:54.875437975 CET | 4953 | 53580 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:59.889004946 CET | 53587 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:53:59.893923044 CET | 4953 | 53587 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:53:59.893999100 CET | 53587 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:01.885876894 CET | 4953 | 53587 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:01.885927916 CET | 53587 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:01.885977030 CET | 53587 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:01.890749931 CET | 4953 | 53587 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:06.896508932 CET | 53631 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:06.901320934 CET | 4953 | 53631 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:06.901396990 CET | 53631 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:08.884836912 CET | 4953 | 53631 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:08.884999037 CET | 53631 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:08.884999037 CET | 53631 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:08.889796972 CET | 4953 | 53631 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:13.896399975 CET | 53676 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:13.901182890 CET | 4953 | 53676 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:13.901256084 CET | 53676 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:15.885672092 CET | 4953 | 53676 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:15.885776043 CET | 53676 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:15.885811090 CET | 53676 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:15.890588045 CET | 4953 | 53676 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:20.903271914 CET | 53722 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:20.908108950 CET | 4953 | 53722 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:20.908195972 CET | 53722 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:22.922518969 CET | 4953 | 53722 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:22.922566891 CET | 53722 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:22.922601938 CET | 53722 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:22.927396059 CET | 4953 | 53722 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:27.928776026 CET | 53769 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:27.933657885 CET | 4953 | 53769 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:27.933736086 CET | 53769 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:29.935127020 CET | 4953 | 53769 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:29.935189962 CET | 53769 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:29.935264111 CET | 53769 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:29.940085888 CET | 4953 | 53769 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:34.944470882 CET | 53816 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:34.949249029 CET | 4953 | 53816 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:34.949321985 CET | 53816 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:36.950282097 CET | 4953 | 53816 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:36.950336933 CET | 53816 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:36.950376987 CET | 53816 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:36.955099106 CET | 4953 | 53816 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:41.959950924 CET | 53852 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:41.964843035 CET | 4953 | 53852 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:41.965048075 CET | 53852 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:43.963937998 CET | 4953 | 53852 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:43.964068890 CET | 53852 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:43.964276075 CET | 53852 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:43.969021082 CET | 4953 | 53852 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:48.975545883 CET | 53853 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:48.980622053 CET | 4953 | 53853 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:48.980714083 CET | 53853 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:50.979974985 CET | 4953 | 53853 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:50.980046988 CET | 53853 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:50.982479095 CET | 53853 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:50.987293959 CET | 4953 | 53853 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:55.991599083 CET | 53854 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:55.996496916 CET | 4953 | 53854 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:55.996577024 CET | 53854 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:57.996923923 CET | 4953 | 53854 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:54:57.996984959 CET | 53854 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:57.997025013 CET | 53854 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:54:58.002331972 CET | 4953 | 53854 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:55:03.006655931 CET | 53855 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:55:03.011559010 CET | 4953 | 53855 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:55:03.011698961 CET | 53855 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:55:05.012833118 CET | 4953 | 53855 | 3.107.255.174 | 192.168.2.4 |
| Jan 3, 2025 13:55:05.012937069 CET | 53855 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:55:05.012937069 CET | 53855 | 4953 | 192.168.2.4 | 3.107.255.174 |
| Jan 3, 2025 13:55:05.017833948 CET | 4953 | 53855 | 3.107.255.174 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 3, 2025 13:53:31.945761919 CET | 53 | 55353 | 162.159.36.2 | 192.168.2.4 |
| Jan 3, 2025 13:53:32.538228035 CET | 53078 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jan 3, 2025 13:53:32.545404911 CET | 53 | 53078 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 3, 2025 13:53:32.538228035 CET | 192.168.2.4 | 1.1.1.1 | 0xaa2e | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 3, 2025 13:53:32.545404911 CET | 1.1.1.1 | 192.168.2.4 | 0xaa2e | Name error (3) | none | none | PTR (Pointer record) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 07:52:57 |
| Start date: | 03/01/2025 |
| Path: | C:\Users\user\Desktop\l3v0.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff681c30000 |
| File size: | 12'288 bytes |
| MD5 hash: | BCE921DA7E4ED6138B0D5CB30952A855 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 07:52:57 |
| Start date: | 03/01/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 20.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 17.7% |
| Total number of Nodes: | 62 |
| Total number of Limit Nodes: | 1 |
Graph
Callgraph
Function 00007FF681C31260 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 94COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF681C31940 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF681C31C0C Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|