Edit tour

Windows Analysis Report
XClient.exe

Overview

General Information

Sample name:	XClient.exe
Analysis ID:	1583745
MD5:	2e525ccebf9ede7492931251eb66571a
SHA1:	a0598bffa349759fb3dcf130cf93ed41a3c3d8f4
SHA256:	fdefedd8f02446dd47723f4b1829f685f64e76b9d29002545dd4c5d5257eae29
Tags:	AsyncRATexemalwaretrojanuser-Joker
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

XClient.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\XClient.exe" MD5: 2E525CCEBF9EDE7492931251EB66571A)

schtasks.exe (PID: 5968 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

XClient.exe (PID: 2132 cmdline: C:\Users\user\AppData\Roaming\XClient.exe MD5: 2E525CCEBF9EDE7492931251EB66571A)

XClient.exe (PID: 5180 cmdline: C:\Users\user\AppData\Roaming\XClient.exe MD5: 2E525CCEBF9EDE7492931251EB66571A)

XClient.exe (PID: 3592 cmdline: C:\Users\user\AppData\Roaming\XClient.exe MD5: 2E525CCEBF9EDE7492931251EB66571A)

XClient.exe (PID: 6496 cmdline: C:\Users\user\AppData\Roaming\XClient.exe MD5: 2E525CCEBF9EDE7492931251EB66571A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["https://pastebin.com/raw/c8qJf1m5"], "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
XClient.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x7211:$str01: $VB$Local_Port 0x7202:$str02: $VB$Local_Host 0x7445:$str03: get_Jpeg 0x6f03:$str04: get_ServicePack 0x8250:$str05: Select * from AntivirusProduct 0x844c:$str06: PCRestart 0x8460:$str07: shutdown.exe /f /r /t 0 0x8512:$str08: StopReport 0x84e8:$str09: StopDDos 0x85de:$str10: sendPlugin 0x877c:$str12: -ExecutionPolicy Bypass -File " 0x88a1:$str13: Content-length: 5235
XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8c60:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8cfd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8e12:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87bc:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\XClient.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x7211:$str01: $VB$Local_Port 0x7202:$str02: $VB$Local_Host 0x7445:$str03: get_Jpeg 0x6f03:$str04: get_ServicePack 0x8250:$str05: Select * from AntivirusProduct 0x844c:$str06: PCRestart 0x8460:$str07: shutdown.exe /f /r /t 0 0x8512:$str08: StopReport 0x84e8:$str09: StopDDos 0x85de:$str10: sendPlugin 0x877c:$str12: -ExecutionPolicy Bypass -File " 0x88a1:$str13: Content-length: 5235
C:\Users\user\AppData\Roaming\XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8c60:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8cfd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8e12:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87bc:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8a60:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8afd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8c12:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x85bc:$cnc4: POST / HTTP/1.1
00000000.00000002.4114219369.00000000025CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: XClient.exe PID: 6884	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.XClient.exe.210000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.XClient.exe.210000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x7211:$str01: $VB$Local_Port 0x7202:$str02: $VB$Local_Host 0x7445:$str03: get_Jpeg 0x6f03:$str04: get_ServicePack 0x8250:$str05: Select * from AntivirusProduct 0x844c:$str06: PCRestart 0x8460:$str07: shutdown.exe /f /r /t 0 0x8512:$str08: StopReport 0x84e8:$str09: StopDDos 0x85de:$str10: sendPlugin 0x877c:$str12: -ExecutionPolicy Bypass -File " 0x88a1:$str13: Content-length: 5235
0.0.XClient.exe.210000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8c60:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8cfd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8e12:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87bc:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\XClient.exe, ProcessId: 6884, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\XClient.exe", ParentImage: C:\Users\user\Desktop\XClient.exe, ParentProcessId: 6884, ParentProcessName: XClient.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe", ProcessId: 5968, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T14:07:19.356985+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:26.053811+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:32.199336+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:45.057721+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:55.943481+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:57.899617+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:07.931512+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:08.429735+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:18.960693+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.225076+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.225960+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.312128+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.358606+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.477694+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:25.839737+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:25.963366+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.322721+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.409395+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.503593+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.597019+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.622947+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.716125+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.809161+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.894946+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.989565+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:35.084120+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:47.867467+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:48.601585+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:49.289059+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.461112+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.551238+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.644750+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.723432+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:53.336467+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:54.930018+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:55.851922+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:55.981477+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:58.211406+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:01.136759+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:06.476691+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:11.325602+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:13.336525+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:13.436101+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:20.229781+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:21.476571+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:21.576018+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:25.399402+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:25.944410+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:27.337864+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:27.338032+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:37.382583+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:37.699959+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:38.299166+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:47.195629+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:47.555250+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:52.648936+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:52.944630+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:55.941742+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:02.589170+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:03.048695+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:03.141843+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.195539+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.322235+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.415532+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:22.664732+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:24.610608+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:25.942800+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.711534+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.809849+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.903054+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.995921+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:35.088920+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.120046+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.213398+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.310161+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.403174+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:50.826218+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:50.920411+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:51.013312+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:51.106485+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:55.246273+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:55.942781+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:56.325098+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:59.308022+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:11:00.870752+0100	2852870	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T14:07:19.383879+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:32.200994+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:45.119776+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:57.900946+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:07.937369+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:08.431252+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:18.962533+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.314165+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.361315+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.479640+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:25.847864+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.328176+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.411984+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.505485+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.603256+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.624385+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.717433+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.810988+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.896488+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.991018+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.085619+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.178907+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.184981+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:47.869276+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:48.602944+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:49.297369+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.464486+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.552997+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.646220+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.725396+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.802939+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.897646+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.902763+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.995663+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.007122+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.088767+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.093644+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:53.342240+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:54.931644+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:55.858233+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:58.258236+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.138062+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.225686+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.322255+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:06.478780+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:11.330253+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:13.344413+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:13.440256+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:20.233278+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:21.484371+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:21.580271+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:25.403642+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:27.339604+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:27.344416+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:37.388404+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:37.704422+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:38.304303+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:47.197312+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:47.558589+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:52.650949+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:52.946369+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.039248+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.044482+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.263432+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:02.591056+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:03.050258+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:03.143437+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.203880+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.323976+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.417056+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:22.666304+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:24.612694+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.713528+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.811492+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.904303+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.997326+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:35.091153+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.121619+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.218478+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.311654+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.405751+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:50.828802+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:50.921759+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:51.015010+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:51.107738+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:55.248291+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:59.337165+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:11:00.871460+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T14:07:26.053811+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:55.943481+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:25.963366+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:55.981477+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:25.944410+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:55.941742+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:25.942800+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:55.942781+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:56.325098+0100	2852874	1	Malware Command and Control Activity Detected	87.120.125.47	7000	192.168.2.4	49731	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T14:08:19.131552+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	49731	87.120.125.47	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XClient.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: XClient.exe

Malware Configuration Extractor: Xworm {"C2 url": ["https://pastebin.com/raw/c8qJf1m5"], "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\XClient.exe	Virustotal: Detection: 68%			Perma Link

Multi AV Scanner detection for submitted file

Source: XClient.exe	ReversingLabs: Detection: 73%
Source: XClient.exe	Virustotal: Detection: 68%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: XClient.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: XClient.exe	String decryptor: https://pastebin.com/raw/c8qJf1m5
Source: XClient.exe	String decryptor: <123456789>
Source: XClient.exe	String decryptor: <Xwormmm>
Source: XClient.exe	String decryptor: XWorm V5.6
Source: XClient.exe	String decryptor: USB.exe
Source: XClient.exe	String decryptor: %AppData%
Source: XClient.exe	String decryptor: XClient.exe

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49731 -> 87.120.125.47:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 87.120.125.47:7000 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49731 -> 87.120.125.47:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 87.120.125.47:7000 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49731 -> 87.120.125.47:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://pastebin.com/raw/c8qJf1m5

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 87.120.125.47:7000

Source: global traffic

HTTP traffic detected: GET /raw/c8qJf1m5 HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.125.47

Source: global traffic

HTTP traffic detected: GET /raw/c8qJf1m5 HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: pastebin.com

Source: XClient.exe, 00000000.00000002.4114219369.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: XClient.exe, 0000000A.00000002.3557691921.0000000002631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/c8qJf1m5

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: XClient.exe, XLogger.cs	.Net Code: KeyboardLayout
Source: XClient.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\XClient.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: XClient.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: XClient.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\XClient.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B88A312	0_2_00007FFD9B88A312
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B88CDF4	0_2_00007FFD9B88CDF4
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B889566	0_2_00007FFD9B889566
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B8805B8	0_2_00007FFD9B8805B8
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 3_2_00007FFD9B8B0C5E	3_2_00007FFD9B8B0C5E
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 7_2_00007FFD9B890C5E	7_2_00007FFD9B890C5E
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 9_2_00007FFD9B8B0C5E	9_2_00007FFD9B8B0C5E
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 10_2_00007FFD9B8A0C5E	10_2_00007FFD9B8A0C5E

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XClient.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: XClient.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: XClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: XClient.exe, Settings.cs	Base64 encoded string: 'ZlD002faNX/VP8ZhkqGXGsdkCkVxk0o/fndQ1CBZ/1mwdtfiAOqqPiDC7p60Ppli', 'T6WVOL3r5tFWPRdyqM02J6v5zc+c8ThmALUekuoVCmskM7E9HuB2ltVG/MtLaVwD', 'M82l2dzmQkcd3ImjFHBM1mL1b+pEkXJRMKTEYK0m0GnJExl+4lrlbS5JIWqWxle7', 'm3HjZ4Cb5qRguCifeAFlU8qxLDI8upw0JU2uLuL8ay/Xu0ptaRRmcgZj1myg/cow'
Source: XClient.exe.0.dr, Settings.cs	Base64 encoded string: 'ZlD002faNX/VP8ZhkqGXGsdkCkVxk0o/fndQ1CBZ/1mwdtfiAOqqPiDC7p60Ppli', 'T6WVOL3r5tFWPRdyqM02J6v5zc+c8ThmALUekuoVCmskM7E9HuB2ltVG/MtLaVwD', 'M82l2dzmQkcd3ImjFHBM1mL1b+pEkXJRMKTEYK0m0GnJExl+4lrlbS5JIWqWxle7', 'm3HjZ4Cb5qRguCifeAFlU8qxLDI8upw0JU2uLuL8ay/Xu0ptaRRmcgZj1myg/cow'

Source: XClient.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: XClient.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/3@1/2

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\XClient.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\lEEsdQo4zb5soE9b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03

Source: XClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: XClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\XClient.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: XClient.exe	ReversingLabs: Detection: 73%
Source: XClient.exe	Virustotal: Detection: 68%

Source: C:\Users\user\Desktop\XClient.exe

File read: C:\Users\user\Desktop\XClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XClient.exe "C:\Users\user\Desktop\XClient.exe"
Source: C:\Users\user\Desktop\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe C:\Users\user\AppData\Roaming\XClient.exe
Source: C:\Users\user\Desktop\XClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: XClient.lnk.0.dr

LNK file: ..\..\..\..\..\XClient.exe

Source: XClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: XClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: XClient.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: XClient.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: XClient.exe, Messages.cs	.Net Code: Memory
Source: XClient.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B8806A8 push ebx; retf	0_2_00007FFD9B8806EA
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B8805FA push ebx; retf	0_2_00007FFD9B88060A
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFD9B8805F8 push ebx; retf	0_2_00007FFD9B88060A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 3_2_00007FFD9B8B0604 push ebx; retf	3_2_00007FFD9B8B060A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 3_2_00007FFD9B8B06D8 push ebx; retf	3_2_00007FFD9B8B06EA
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 7_2_00007FFD9B8905FA push ebx; retf	7_2_00007FFD9B89060A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 7_2_00007FFD9B8906A8 push ebx; retf	7_2_00007FFD9B8906EA
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 9_2_00007FFD9B8B0604 push ebx; retf	9_2_00007FFD9B8B060A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 9_2_00007FFD9B8B06D8 push ebx; retf	9_2_00007FFD9B8B06EA
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 10_2_00007FFD9B8A05FA push ebx; retf	10_2_00007FFD9B8A060A
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 10_2_00007FFD9B8A06D7 push ebx; retf	10_2_00007FFD9B8A06EA

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\XClient.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\XClient.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 1A580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 11E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1AD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1A270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 16D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1B1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 23D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1A620000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Window / User API: threadDelayed 6106			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Window / User API: threadDelayed 3694			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe TID: 6532	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 5804	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 3052	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 3140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 6596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: XClient.exe, 00000000.00000002.4116138883.000000001B4F0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\XClient.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\Users\user\Desktop\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4114219369.00000000025CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4114219369.00000000025CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Clipboard Data	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XClient.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
XClient.exe	68%	Virustotal		Browse
XClient.exe	100%	Avira	TR/Spy.Gen
XClient.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XClient.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\XClient.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XClient.exe	74%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
C:\Users\user\AppData\Roaming\XClient.exe	68%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pastebin.com	172.67.19.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/c8qJf1m5	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	XClient.exe, 00000000.00000002.4114219369.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.19.24	pastebin.com	United States		13335	CLOUDFLARENETUS	false
87.120.125.47	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583745
Start date and time:	2025-01-03 14:06:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XClient.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/3@1/2
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 100% Number of executed functions: 37 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target XClient.exe, PID 2132 because it is empty
Execution Graph export aborted for target XClient.exe, PID 3592 because it is empty
Execution Graph export aborted for target XClient.exe, PID 5180 because it is empty
Execution Graph export aborted for target XClient.exe, PID 6496 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:07:05	API Interceptor	13854016x Sleep call for process: XClient.exe modified
13:06:59	Task Scheduler	Run new task: XClient path: C:\Users\user\AppData\Roaming\XClient.exe
13:06:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.19.24	rrats.exe	Get hash	malicious	AsyncRAT	Browse	pastebin.com/raw/KKpnJShN
	sys_upd.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm2.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse	pastebin.com/raw/sA04Mwk2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	CRf9KBk4ra.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	bad.txt	Get hash	malicious	AsyncRAT	Browse	104.20.3.235
	dlhost.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	htkeUc1zJ0.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	c2.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk	Get hash	malicious	Unknown	Browse	172.67.19.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	87.120.113.91
	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	87.120.115.216
	rebirth.arm4t.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.sh4.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.x86.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.ppc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
CLOUDFLARENETUS	7z91gvU.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	104.26.13.205
	mode11_0HVJ.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	https://goatstuff.sbs/re5.mp4	Get hash	malicious	Unknown	Browse	188.114.96.3
	mode11_AKUh.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	mode11_qLf2.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	mode11_UVo6.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	mode11_buqd.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	mode11_N1Fz.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	http://t1.awagama2.org	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	1111.hta	Get hash	malicious	Unknown	Browse	172.67.19.24
	qwertyuiopasdfghjklzxcvbnm.hta	Get hash	malicious	Unknown	Browse	172.67.19.24
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.19.24
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.19.24
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	172.67.19.24
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	RFQ-12202431_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	Sylacauga AL License.msg	Get hash	malicious	Unknown	Browse	172.67.19.24

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Jan 3 12:06:58 2025, mtime=Fri Jan 3 12:06:59 2025, atime=Fri Jan 3 12:06:58 2025, length=41984, window=hide
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.053190431527314
Encrypted:	false
SSDEEP:	12:8j324I9hTWC78dY//ILp0La/djAsKrHkfpqHrHoBmV:8jDI9ws8+kU0ZAsKYfpqHrHoBm
MD5:	A7EF7354D416D3A12E1F1B289197CA04
SHA1:	565B54A914DA690B7D1D2BDEF652004B6CA773A1
SHA-256:	E50C9E500CCC767E5D501C28AED1636301C62D8597A48F41B4B560AFFAC4679E
SHA-512:	2B557608928B2A77FD4F23736E3A22BC5C6ECCEC9EAD981CF8691B5E713429E76A4C40424E488E20F41CE0E270A3FEA63777E11DD62BA97B413975A29D21FBA7
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....\|.^.]..0wq_.]...\|.^.]..........................v.:..DG..Yr?.D..U..k0.&...&......vk.v.....-OX.]...R,_.]......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^#Z.h...........................%..A.p.p.D.a.t.a...B.V.1.....#Z.h..Roaming.@......CW.^#Z.h..........................eSe.R.o.a.m.i.n.g.....b.2.....#Z.h .XClient.exe.H......#Z.h#Z.h...........................u..X.C.l.i.e.n.t...e.x.e.......Y...............-.......X............*z......C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......210979...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.594602217818213
Encrypted:	false
SSDEEP:	768:hJn0mOvGjMI5r2NpaNFu9vsOChR6RklT:ht0raCNaFu9vsOCLYmT
MD5:	2E525CCEBF9EDE7492931251EB66571A
SHA1:	A0598BFFA349759FB3DCF130CF93ED41A3C3D8F4
SHA-256:	FDEFEDD8F02446DD47723F4B1829F685F64E76B9D29002545DD4C5D5257EAE29
SHA-512:	2E459CA08A91FE27F0C3BE7BC73E5EC9E3B10B17CE99F11372DA0E0176E8647419E8C1B0478F0D3CE763246E92B84293AB42CE9769BB8BBF3F9B3D7DDA9FEA01
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74% Antivirus: Virustotal, Detection: 68%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!mg................................ ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......L\..<\............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.594602217818213
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	XClient.exe
File size:	41'984 bytes
MD5:	2e525ccebf9ede7492931251eb66571a
SHA1:	a0598bffa349759fb3dcf130cf93ed41a3c3d8f4
SHA256:	fdefedd8f02446dd47723f4b1829f685f64e76b9d29002545dd4c5d5257eae29
SHA512:	2e459ca08a91fe27f0c3be7bc73e5ec9e3b10b17ce99f11372da0e0176e8647419e8c1b0478f0d3ce763246e92b84293ab42ce9769bb8bbf3f9b3d7dda9fea01
SSDEEP:	768:hJn0mOvGjMI5r2NpaNFu9vsOChR6RklT:ht0raCNaFu9vsOCLYmT
TLSH:	0A135C0837E04626D9FF6FF959F362030B31E5035913D7AE0CE5899B1B67B84CA4179A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!mg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40b8de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676D21E8 [Thu Dec 26 09:29:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb888	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x98e4	0x9a00	671f9584bf24256d711c81f614358341	False	0.4957132711038961	data	5.713572049892492	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4d8	0x600	2472af5ddbb53779b7381f16b8b9407b	False	0.3756510416666667	data	3.7216503306685733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	24f7d304061bf2d9404c5ca731b0cde8	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x244	data			0.4724137931034483
RT_MANIFEST	0xc2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T14:07:19.183005+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:19.356985+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:19.383879+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:26.053811+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:26.053811+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:32.199336+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:32.200994+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:45.057721+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:45.119776+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:07:55.943481+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:55.943481+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:57.899617+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:07:57.900946+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:07.931512+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:07.937369+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:08.429735+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:08.431252+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:18.960693+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:18.962533+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.131552+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.225076+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.225960+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.312128+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.314165+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.358606+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.361315+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:19.477694+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:19.479640+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:25.839737+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:25.847864+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:25.963366+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:25.963366+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.322721+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.328176+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.409395+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.411984+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.503593+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.505485+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:29.597019+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:29.603256+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.622947+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.624385+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.716125+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.717433+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.809161+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.810988+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.894946+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.896488+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:34.989565+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:34.991018+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.084120+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:35.085619+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.178907+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:35.184981+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:47.867467+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:47.869276+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:48.601585+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:48.602944+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:49.289059+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:49.297369+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.461112+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.464486+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.551238+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.552997+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.644750+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.646220+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.723432+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:50.725396+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.802939+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.897646+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.902763+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:50.995663+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.007122+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.088767+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:51.093644+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:53.336467+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:53.342240+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:54.930018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:54.931644+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:55.851922+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:55.858233+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:08:55.981477+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:55.981477+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:58.211406+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:08:58.258236+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.136759+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:01.138062+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.225686+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:01.322255+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:06.476691+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:06.478780+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:11.325602+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:11.330253+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:13.336525+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:13.344413+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:13.436101+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:13.440256+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:20.229781+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:20.233278+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:21.476571+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:21.484371+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:21.576018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:21.580271+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:25.399402+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:25.403642+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:25.944410+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:25.944410+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:27.337864+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:27.338032+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:27.339604+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:27.344416+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:37.382583+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:37.388404+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:37.699959+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:37.704422+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:38.299166+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:38.304303+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:47.195629+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:47.197312+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:47.555250+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:47.558589+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:52.648936+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:52.650949+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:52.944630+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:52.946369+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.039248+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.044482+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:53.263432+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:09:55.941742+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:09:55.941742+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:02.589170+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:02.591056+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:03.048695+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:03.050258+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:03.141843+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:03.143437+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.195539+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.203880+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.322235+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.323976+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:13.415532+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:13.417056+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:22.664732+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:22.666304+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:24.610608+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:24.612694+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:25.942800+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:25.942800+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.711534+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.713528+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.809849+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.811492+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.903054+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.904303+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:34.995921+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:34.997326+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:35.088920+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:35.091153+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.120046+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.121619+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.213398+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.218478+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.310161+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.311654+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:45.403174+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:45.405751+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:50.826218+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:50.828802+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:50.920411+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:50.921759+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:51.013312+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:51.015010+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:51.106485+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:51.107738+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:55.246273+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:55.248291+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:10:55.942781+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:55.942781+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:56.325098+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:56.325098+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:59.308022+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:10:59.337165+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP
2025-01-03T14:11:00.870752+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.125.47	7000	192.168.2.4	49731	TCP
2025-01-03T14:11:00.871460+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49731	87.120.125.47	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 14:07:00.570508957 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:00.570538998 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:00.570601940 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:00.591351032 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:00.591362953 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.072931051 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.073010921 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:01.077982903 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:01.077991009 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.078263044 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.131035089 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:01.141375065 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:01.187341928 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.633932114 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.633997917 CET	443	49730	172.67.19.24	192.168.2.4
Jan 3, 2025 14:07:01.634056091 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:01.650686026 CET	49730	443	192.168.2.4	172.67.19.24
Jan 3, 2025 14:07:05.869640112 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:05.874458075 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:05.874562979 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:06.324534893 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:06.329504967 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:19.183005095 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:19.187800884 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:19.356985092 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:19.383878946 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:19.388684034 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:26.053811073 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:26.099967003 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:32.022135973 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:32.027098894 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:32.199336052 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:32.200994015 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:32.205818892 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:44.884918928 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:44.889780045 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:45.057720900 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:45.099874020 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:45.119776011 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:45.124532938 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:55.943480968 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:55.990519047 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:57.725306034 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:57.730151892 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:57.899616957 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:07:57.900945902 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:07:57.905721903 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:07.756355047 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:07.762268066 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:07.931512117 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:07.937369108 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:07.942197084 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:08.256393909 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:08.261279106 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:08.429734945 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:08.431252003 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:08.436053991 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.787636995 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:18.792474031 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.834656000 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:18.839473009 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.881438971 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:18.886223078 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.960692883 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.962532997 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:18.967334986 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:18.990848064 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:18.995594025 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.006355047 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.011183977 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.131551981 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.225075960 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.225960016 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.226166964 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.266690969 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.266872883 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.271687031 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.312128067 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.314165115 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.318886995 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.358606100 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.361315012 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.406749010 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.477694035 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:19.479640007 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:19.484831095 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:25.664558887 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:25.669495106 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:25.839736938 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:25.847863913 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:25.852660894 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:25.963366032 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:26.008635998 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.147136927 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.151952982 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.209532976 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.214330912 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.225193024 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.229939938 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.242178917 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.246936083 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.322721004 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.328176022 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.333012104 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.409394979 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.411983967 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.416729927 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.503592968 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.505485058 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.510258913 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.597018957 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:29.603255987 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:29.608057022 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.444206953 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.449059010 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.459568977 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.464490891 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.521974087 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.526839972 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.584481955 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.589437962 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.622946978 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.624385118 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.670773029 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.716125011 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.717432976 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.722318888 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.740725040 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.745539904 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.803270102 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.808172941 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.809160948 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.810987949 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.862684965 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.862751007 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.867630959 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.894946098 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.896487951 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.946677923 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.989564896 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:34.991018057 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:34.995874882 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:35.084120035 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:35.085618973 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:35.091948986 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:35.177324057 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:35.178906918 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:35.184926033 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:35.184981108 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:35.192368031 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:47.694211960 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:47.699204922 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:47.867466927 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:47.869276047 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:47.874152899 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:48.428359032 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:48.433171034 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:48.601584911 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:48.602943897 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:48.607712030 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:49.100320101 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:49.105288982 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:49.289058924 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:49.297369003 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:49.302191973 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.287803888 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.294152975 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.303428888 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.308176994 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.397253990 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.402205944 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.412857056 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.417670965 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.459589958 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.461112022 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.464441061 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.464485884 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.469297886 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.491030931 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.495872021 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.522097111 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.526844025 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.551238060 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.552997112 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.602659941 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.602701902 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.607474089 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.615828037 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.620634079 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.631659985 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.636467934 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.644750118 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.646219969 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.694943905 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.694988012 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.699897051 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.709585905 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.714519978 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.723432064 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.725395918 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.771015882 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.772102118 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.777127981 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.801326036 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.802938938 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.850686073 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.850730896 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.858294964 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.896190882 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.897645950 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.902718067 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.902762890 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:50.908036947 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.989243031 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:50.995662928 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:51.000813961 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:51.007122040 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:51.011960030 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:51.087438107 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:51.088767052 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:51.093604088 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:51.093643904 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:51.098505974 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:53.162769079 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:53.167727947 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:53.336467028 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:53.342240095 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:53.347342968 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:54.757023096 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:54.761883020 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:54.930017948 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:54.931643963 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:54.936472893 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:55.678410053 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:55.683208942 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:55.851922035 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:55.858232975 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:55.862997055 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:55.981477022 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:56.021889925 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:58.038238049 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:58.043104887 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:58.211405993 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:08:58.258235931 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:08:58.263151884 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.881724119 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.886604071 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.897136927 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.901989937 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.912827015 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.917604923 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.928392887 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.933173895 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.944117069 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.949037075 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:00.991055965 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:00.995862961 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.006478071 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.011265039 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.022125959 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.026892900 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.037713051 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.042470932 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.136759043 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.138062000 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.142874002 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.223908901 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.225686073 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.230519056 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.230571985 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.235321999 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.317476988 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.322254896 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.327035904 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:01.327249050 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:01.332053900 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:06.303385973 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:06.308279037 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:06.476691008 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:06.478780031 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:06.483604908 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:11.147185087 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:11.152177095 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:11.325602055 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:11.330252886 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:11.336361885 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.162929058 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:13.167831898 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.240856886 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:13.245601892 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.336524963 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.344413042 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:13.349169016 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.436100960 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:13.440256119 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:13.445099115 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:20.054263115 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:20.059138060 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:20.229780912 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:20.233278036 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:20.238120079 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.303472042 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:21.308506012 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.336880922 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:21.341886044 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.476571083 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.484370947 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:21.489181042 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.576018095 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:21.580271006 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:21.585058928 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:25.225289106 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:25.230216026 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:25.399401903 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:25.403641939 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:25.408500910 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:25.944410086 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:25.992320061 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.069315910 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.074270010 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:27.100428104 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.105164051 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:27.337863922 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:27.338032007 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:27.338072062 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.339603901 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.344372988 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:27.344415903 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:27.349155903 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.209697962 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:37.214675903 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.382582903 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.388403893 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:37.393177986 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.522829056 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:37.527776957 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.699959040 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:37.704421997 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:37.709183931 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:38.100297928 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:38.105164051 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:38.299165964 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:38.304302931 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:38.309079885 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.022329092 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:47.027363062 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.195628881 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.197312117 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:47.202105045 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.381680965 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:47.386449099 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.555249929 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:47.558588982 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:47.563453913 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.475389957 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.480324984 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.648936033 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.650949001 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.655719042 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.662841082 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.667644024 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.694119930 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.698978901 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.709759951 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.714529991 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.772186995 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.777007103 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.787825108 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.792607069 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.803464890 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.808294058 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.944629908 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:52.946368933 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:52.951124907 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.037945986 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.039247990 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:53.044435978 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.044481993 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:53.049662113 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.262099028 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.263432026 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:53.268213987 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:53.268265009 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:09:53.273133039 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:55.941741943 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:09:55.992388964 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:02.412970066 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:02.417853117 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:02.589169979 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:02.591056108 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:02.595844984 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:02.866190910 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:02.871062994 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:02.881937027 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:02.886919022 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:03.048695087 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:03.050257921 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:03.057060957 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:03.141843081 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:03.143436909 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:03.148576021 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.022377014 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.027226925 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.131850004 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.136750937 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.178540945 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.183330059 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.195538998 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.203880072 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.250699043 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.322235107 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.323976040 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.328727961 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.415532112 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:13.417056084 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:13.421822071 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:22.491461992 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:22.496253014 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:22.664731979 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:22.666304111 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:22.671164036 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:24.428664923 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:24.435165882 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:24.610608101 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:24.612694025 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:24.617470980 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:25.942800045 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:25.992396116 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.538135052 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.543016911 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.631721973 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.636612892 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.647265911 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.652137041 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.662950993 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.667853117 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.711534023 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.713527918 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.718365908 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.788079977 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.793051958 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.809849024 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.811491966 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.858639002 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.903053999 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.904303074 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:34.909064054 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.995920897 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:34.997325897 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:35.002484083 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:35.088920116 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:35.091152906 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:35.095947981 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:44.929065943 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:44.933969021 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.022392035 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.027885914 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.053906918 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.059375048 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.069839001 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.075206995 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.120045900 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.121618986 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.126370907 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.213397980 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.218477964 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.223381996 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.310161114 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.311654091 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.316414118 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.403173923 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:45.405750990 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:45.410511971 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.648050070 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.652829885 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.662919044 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.667722940 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.725528955 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.730371952 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.741065979 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.745810032 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.826217890 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.828802109 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.833642960 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.920411110 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:50.921758890 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:50.926549911 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:51.013312101 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:51.015010118 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:51.019756079 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:51.106484890 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:51.107738018 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:51.112509012 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:55.069255114 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:55.074157000 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:55.246273041 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:55.248291016 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:55.253109932 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:55.942780972 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:56.147120953 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:56.325098038 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:56.325205088 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:59.116274118 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:59.121182919 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:59.308022022 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:10:59.337165117 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:10:59.342147112 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:11:00.694281101 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:11:00.699126005 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:11:00.870752096 CET	7000	49731	87.120.125.47	192.168.2.4
Jan 3, 2025 14:11:00.871459961 CET	49731	7000	192.168.2.4	87.120.125.47
Jan 3, 2025 14:11:00.877003908 CET	7000	49731	87.120.125.47	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 14:07:00.551600933 CET	55325	53	192.168.2.4	1.1.1.1
Jan 3, 2025 14:07:00.562392950 CET	53	55325	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 14:07:00.551600933 CET	192.168.2.4	1.1.1.1	0xd56d	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 14:07:00.562392950 CET	1.1.1.1	192.168.2.4	0xd56d	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Jan 3, 2025 14:07:00.562392950 CET	1.1.1.1	192.168.2.4	0xd56d	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Jan 3, 2025 14:07:00.562392950 CET	1.1.1.1	192.168.2.4	0xd56d	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.19.24	443	6884	C:\Users\user\Desktop\XClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 13:07:01 UTC	74	OUT	GET /raw/c8qJf1m5 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2025-01-03 13:07:01 UTC	388	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 13:07:01 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Fri, 03 Jan 2025 13:07:01 GMT Server: cloudflare CF-RAY: 8fc3359c7ecb18b8-EWR
2025-01-03 13:07:01 UTC	24	IN	Data Raw: 31 32 0d 0a 38 37 2e 31 32 30 2e 31 32 35 2e 34 37 3a 37 30 30 30 0d 0a Data Ascii: 1287.120.125.47:7000
2025-01-03 13:07:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:06:54
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\XClient.exe"
Imagebase:	0x210000
File size:	41'984 bytes
MD5 hash:	2E525CCEBF9EDE7492931251EB66571A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1658447422.0000000000212000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4114219369.00000000025CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:06:58
Start date:	03/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:06:58
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:06:59
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0xaa0000
File size:	41'984 bytes
MD5 hash:	2E525CCEBF9EDE7492931251EB66571A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:08:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0x20000
File size:	41'984 bytes
MD5 hash:	2E525CCEBF9EDE7492931251EB66571A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:09:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0xf90000
File size:	41'984 bytes
MD5 hash:	2E525CCEBF9EDE7492931251EB66571A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:10:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\XClient.exe
Imagebase:	0x4d0000
File size:	41'984 bytes
MD5 hash:	2E525CCEBF9EDE7492931251EB66571A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B88CDF4 Relevance: 2.4, Strings: 1, Instructions: 1132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9B88D926

Memory Dump Source

Source File: 00000000.00000002.4117209297.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ffe52e5f2479a655929fdfb20da64ce995ee1005573560dc6d11de75136cb4e2
Instruction ID: aa11739422e0363d3083def3c475c0433adab0cf0a8486eca342088964888046
Opcode Fuzzy Hash: ffe52e5f2479a655929fdfb20da64ce995ee1005573560dc6d11de75136cb4e2
Instruction Fuzzy Hash: 01725620B1D90D4BEBA8FB6884A5A7972D2FF9C304F554579D02ED32E7DE38E8428741

Function 00007FFD9B8805B8 Relevance: 1.0, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4117209297.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1091a3df13a0a4a7615933bb4acefa3809ad35b89bf32639e52f15980538419
Instruction ID: aaa06a9f5a53326c754fccaeda4ddce5b0ccd359c6a52d1e3ccff0cfdd992cfd
Opcode Fuzzy Hash: f1091a3df13a0a4a7615933bb4acefa3809ad35b89bf32639e52f15980538419
Instruction Fuzzy Hash: B2620861B29E094FE7A8FB6C9875679B6D2EF9C304F4505B9E01EC32DADD38A8018741

Function 00007FFD9B889566 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4117209297.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf8e0c694c1ffb6754ec79f74f7a6b775c6d699c01082e3ab193f780616137e
Instruction ID: 92e30c0a7313f81627621525b669462281174a6a3975323d0fb80dcb854cb07e
Opcode Fuzzy Hash: ecf8e0c694c1ffb6754ec79f74f7a6b775c6d699c01082e3ab193f780616137e
Instruction Fuzzy Hash: DDF1D530A09E4E8FEBA8DF68D8597E937D1FF58310F04466EE85DC7295DB3499408B82

Function 00007FFD9B88A312 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4117209297.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea038dee7154fe83a996e98f1d2498ba9a2c9d4ef72795975248779aa02d983
Instruction ID: cddeee9447933508adc4bde2bba0099ed1f125d0876ade73fbda20aa3cb4bd14
Opcode Fuzzy Hash: eea038dee7154fe83a996e98f1d2498ba9a2c9d4ef72795975248779aa02d983
Instruction Fuzzy Hash: C6E1E430A09E4D8FEBA8DF68C8557E977D1FF58310F04426ED85DC72E5DA78A9408B82

Function 00007FFD9B883A68 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B883B31

Memory Dump Source

Source File: 00000000.00000002.4117209297.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_XClient.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2175d6044e1fabf81b224838e98d95c9f498410c5805a52f98df7858fff6b2de
Instruction ID: feeb6b7f23be814906d4a99e2977da148b147fc4348afcce3ba79c10c0942c38
Opcode Fuzzy Hash: 2175d6044e1fabf81b224838e98d95c9f498410c5805a52f98df7858fff6b2de
Instruction Fuzzy Hash: A341E730A0CE4D4FDB1CEB6C98566F9BBE1EF59321F00427EE059C3192DA75A81287C1

Analysis Process: XClient.exePID: 2132, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B0C5E Relevance: 1.0, Instructions: 1021COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43aeb10d008f66eb15092c04babc2d5a105de5692c8ef57a111f213e9cdeb5f7
Instruction ID: ee1f97d7edcd8b4fa0df03994319b840e6e2ab9664defab6baaf6c08026ec59c
Opcode Fuzzy Hash: 43aeb10d008f66eb15092c04babc2d5a105de5692c8ef57a111f213e9cdeb5f7
Instruction Fuzzy Hash: EA62E661B29A594FE798FB7888756B977D2FF9C300F4405B9E01DC32D7DE28A8428781

Function 00007FFD9B8B0730 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb45995b91574b02903eed342a9544c00ffe163c323dd53f957003db2c1a011
Instruction ID: 4f11872402b21a909e3777ecf71c759d134fb10aa2b58334775b097755468a7a
Opcode Fuzzy Hash: 6cb45995b91574b02903eed342a9544c00ffe163c323dd53f957003db2c1a011
Instruction Fuzzy Hash: 634118E2B095998FD34AB768FC759E87F61EF48214B8445F2D05D873CBED3825428782

Function 00007FFD9B8B17E1 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d01f3f508d4b3f75c93edafafff6f7dcb28488229271226e2df27b1ab8d61b3
Instruction ID: 92350e31320df6da92f8d6e30026adeb8003a292f3a939590199bc9c1c4b69bb
Opcode Fuzzy Hash: 1d01f3f508d4b3f75c93edafafff6f7dcb28488229271226e2df27b1ab8d61b3
Instruction Fuzzy Hash: 40510310B1E6C90FD756AB7848756796FD1EF8A219B0900FBE089CB1EBDD185806C342

Function 00007FFD9B8B07A8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a380419a7dff6102fc5e7f6650df8c7191f98788f361bfa941b154ecc969a2e
Instruction ID: 45a6947c9c4f93c4e81dda8310c63c14a57256f3f10ee52cd1ad7975730d7b1f
Opcode Fuzzy Hash: 8a380419a7dff6102fc5e7f6650df8c7191f98788f361bfa941b154ecc969a2e
Instruction Fuzzy Hash: DF31B4E1759A894FD389EB28E4B09E9BF71EF8C201BC044A5D019C33DBDD3869018782

Function 00007FFD9B8B04E0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2901a624b8f7ecd92b3c0228715d2beb82d823769d2a414708d58a78d2cbcd6
Instruction ID: e2e7548131699e6b9c362aef56c1bf4e4d25e8e19f66c41a989726bbd08823e3
Opcode Fuzzy Hash: f2901a624b8f7ecd92b3c0228715d2beb82d823769d2a414708d58a78d2cbcd6
Instruction Fuzzy Hash: DF31EA21B189490FD798FB2C987A679A2C1EF9C315F0501BEE00EC72EBDE689C018741

Function 00007FFD9B8B09A9 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417d4731ccda7f43aba10b779d0807ce6a110deb51bfa0b8e1883f2be18cb688
Instruction ID: b43a77422da57a4e7fd747e2456d0bea92e6a77c51bf74768cd7a1375c0de978
Opcode Fuzzy Hash: 417d4731ccda7f43aba10b779d0807ce6a110deb51bfa0b8e1883f2be18cb688
Instruction Fuzzy Hash: 2841C370A18A594FDB49EB78D861AED7BB1FF88300F9005B5D009D33D6DE38A801C781

Function 00007FFD9B8B0B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b5c4e98baf6e341638edda66431d42c9b168119fbcb42eeb334a33a1f350b2
Instruction ID: 7803e422d1136a6b6b5d3c874e7e2f1abf1f0e2d43eb12486e7901e2174a0cad
Opcode Fuzzy Hash: 50b5c4e98baf6e341638edda66431d42c9b168119fbcb42eeb334a33a1f350b2
Instruction Fuzzy Hash: 74215A21F149194BEB58BBBC586A7FC72D2FF9C715F100176E01DC32DADD1868424791

Function 00007FFD9B8B1981 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1748458560.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457c96d93915e53c0993e45d39756a15bd39a632904e065f926e272037147606
Instruction ID: e2c1afba78aae1eeecd4071edddba1da76b646a8c8fbf902b3c6338282df8648
Opcode Fuzzy Hash: 457c96d93915e53c0993e45d39756a15bd39a632904e065f926e272037147606
Instruction Fuzzy Hash: D4016D52B1EAA90FF751737878215727FE0DF9A261B4905B7F888CA1A7E8085A4143D2

Analysis Process: XClient.exePID: 5180, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B890C5E Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada08eed77c929611449963c8fe238b614173b4f504e970fb0b04b50caac592
Instruction ID: 9c635304fa9f536ebae9f4d166cafbb72c8471d053cbbf6010834de7fc7448af
Opcode Fuzzy Hash: dada08eed77c929611449963c8fe238b614173b4f504e970fb0b04b50caac592
Instruction Fuzzy Hash: D162EB61B1DA494FEB58FB7C947A6BDB7D2EF98300F4405B9E05DC32DADD28A8428341

Function 00007FFD9B890730 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a441b137bed92704be88a2ecd4bcae9d3cb2c529e0b5fd434512fbf4e0563cf8
Instruction ID: 08e46f1d9f350818ad1966a6d3f45b2aca67388d3cb7ba2f8a02a448296de20a
Opcode Fuzzy Hash: a441b137bed92704be88a2ecd4bcae9d3cb2c529e0b5fd434512fbf4e0563cf8
Instruction Fuzzy Hash: D641E362B0D5598BD709BB68BC7A8ECBF61EF54214B8441F2D45D872CFED3824468782

Function 00007FFD9B8917E1 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5d1719c8dfefd8f8b47f3ac489e0f48c0e36f4f247a478b91140b92590e98b
Instruction ID: c4af62a873dd3ca7d91dabbc8d9c9f2cdedf7c5130ca0a1886fb3ea24a3338cf
Opcode Fuzzy Hash: ae5d1719c8dfefd8f8b47f3ac489e0f48c0e36f4f247a478b91140b92590e98b
Instruction Fuzzy Hash: 68510120B1E6C90FDB96AB7C48756796FD1DF8A219B0901FBE099C71EBDE185806C342

Function 00007FFD9B8907A8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4acc0945755c0c84b7c858afcc836cb53ad86e09e6d2f0b938731e1bde2f04a
Instruction ID: 81ccf82b6b92fcb977a95ed97545442a38a96e09e1621485c0a5c51756a51ac2
Opcode Fuzzy Hash: a4acc0945755c0c84b7c858afcc836cb53ad86e09e6d2f0b938731e1bde2f04a
Instruction Fuzzy Hash: 9031946175DA894FD348EB28A4B68BDBFB1FFA8200BC045A5D419C33DEDD3469098752

Function 00007FFD9B8904E0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7825b186defd27461806548f5b9e70a4fdc26c09c56b253820766bf99d6c553
Instruction ID: f8f6d651b5bce7f33e8898340aa53565545034b5d4d7869aa7c4d98d5b8a3ccc
Opcode Fuzzy Hash: b7825b186defd27461806548f5b9e70a4fdc26c09c56b253820766bf99d6c553
Instruction Fuzzy Hash: 1131CA21B1C9490FEB98FB2C587A679A6C1EF9C355F0505BEE05EC32EBDE685C418341

Function 00007FFD9B8909A9 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b19b07829332da02dfc6e782edbf1d8cb81e4b222e67d954a935f704a0f192d
Instruction ID: 301d0322136a7bd89bc80b858811f044dcf93d5c5ad7e766299f447d38b23387
Opcode Fuzzy Hash: 0b19b07829332da02dfc6e782edbf1d8cb81e4b222e67d954a935f704a0f192d
Instruction Fuzzy Hash: 6F419431A18A4D4FDB48EB68D8656EDBBB1FF99300F5105B9D019D32DADE38A805C741

Function 00007FFD9B890B48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46d89a385447af755cc829978e1d0872fd09819bfb657b38a39e342e0b37982
Instruction ID: 8f797c8f4f07b99bbb34ea0e9846bedf703815ee3f59d788942a4f86c31a1698
Opcode Fuzzy Hash: d46d89a385447af755cc829978e1d0872fd09819bfb657b38a39e342e0b37982
Instruction Fuzzy Hash: D1215761F14D098BEB48BBBC586A7BC72D2FF98715F10017AE11DC32DADD28A8424341

Function 00007FFD9B891981 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2357450182.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3c869c5b6584b53b27e54bd8bdc135bed9cd367ee73050fe225b4f5b36688a
Instruction ID: bcbbf097d8ea008e8f5c36bf88eb3b9b81fe3dce83a4845b82835f46f01c4fd0
Opcode Fuzzy Hash: 3b3c869c5b6584b53b27e54bd8bdc135bed9cd367ee73050fe225b4f5b36688a
Instruction Fuzzy Hash: 08016D16B0E6991FFB51776878215757FE0CBD6260B4905B7F8C9C60A7E8085A414392

Analysis Process: XClient.exePID: 3592, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B0C5E Relevance: 1.0, Instructions: 1021COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805424396a6afc70c99d55ba5bd9e1f2b97e42606811afb77eff3629c80baf8e
Instruction ID: 5d939faf02616f50a4d2be35351488f8993b73ef3a5388da496a1d4511e49000
Opcode Fuzzy Hash: 805424396a6afc70c99d55ba5bd9e1f2b97e42606811afb77eff3629c80baf8e
Instruction Fuzzy Hash: 8A62C821B29A594FE79CFB7C847567977D2FF98304F4401B9E05DC32DAED28A8428781

Function 00007FFD9B8B0730 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2daba5ffc3eba50ab693d800ea13eff49e9ab86cb921ca1917076337b3b1098f
Instruction ID: e54ff6fcc93d05525d08a726fabc67fe4e5944b4b43c1a8379aaff7ad3f1b914
Opcode Fuzzy Hash: 2daba5ffc3eba50ab693d800ea13eff49e9ab86cb921ca1917076337b3b1098f
Instruction Fuzzy Hash: 60412821B085598BD74EBB68ACB58E87B72EF48318B8441F2D45D832CFFD3C25428792

Function 00007FFD9B8B17E1 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cc70c2c2b1b180ca2155ae6ad4a62022a99ba0b958b8f7e90b363a01dd8c8f
Instruction ID: 93b0ea9e0567ceca73c2a3081dc5affbbea785c0f2324f9c85a39dcb7de89ad7
Opcode Fuzzy Hash: 93cc70c2c2b1b180ca2155ae6ad4a62022a99ba0b958b8f7e90b363a01dd8c8f
Instruction Fuzzy Hash: 4A510310B1E6C90FD796AB7848756796FD1EF8A219B0900FBE089CB1EBDD185806C342

Function 00007FFD9B8B07A8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390bcffb736dfcb70cd0eebd86ca16e1bebbef19b6c6bd5dfe5646f49424a6ae
Instruction ID: 3e9baa77678e91136398e8cc784a8488d815b801868bef31afaa7889e3540719
Opcode Fuzzy Hash: 390bcffb736dfcb70cd0eebd86ca16e1bebbef19b6c6bd5dfe5646f49424a6ae
Instruction Fuzzy Hash: 8D319820B19A4D8FD78DF72894B58A9BF72EF883047C045A5D819C33DFED3869058762

Function 00007FFD9B8B04E0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db067edef9015a5fc29d7870068136a3bba954b97c307c80b0ff9f0aae178bd0
Instruction ID: edd8a2fa582c5176062a9003ffaaa99b872987b1322f4b4f034691d8a3d38c5d
Opcode Fuzzy Hash: db067edef9015a5fc29d7870068136a3bba954b97c307c80b0ff9f0aae178bd0
Instruction Fuzzy Hash: AD31FB21B1894D0FD798FB2C587A679A6C1EF9C315F0501BEE00EC72EBDE689C018741

Function 00007FFD9B8B09A9 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f979c5aa0f76b53f6c3ee3b58a1743f739252130b4128edceca3c2a1db7db4e
Instruction ID: 61f8ee649642f97c9d48c015b65add8bc1f5b68a6ca337fef753fd3b7d3f0078
Opcode Fuzzy Hash: 1f979c5aa0f76b53f6c3ee3b58a1743f739252130b4128edceca3c2a1db7db4e
Instruction Fuzzy Hash: 4441B430A18A1D8FDB49EB78C861AEDB7B2FF99300F9005B5D019D32DADE386841C751

Function 00007FFD9B8B0B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b5c4e98baf6e341638edda66431d42c9b168119fbcb42eeb334a33a1f350b2
Instruction ID: 7803e422d1136a6b6b5d3c874e7e2f1abf1f0e2d43eb12486e7901e2174a0cad
Opcode Fuzzy Hash: 50b5c4e98baf6e341638edda66431d42c9b168119fbcb42eeb334a33a1f350b2
Instruction Fuzzy Hash: 74215A21F149194BEB58BBBC586A7FC72D2FF9C715F100176E01DC32DADD1868424791

Function 00007FFD9B8B1981 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2957620656.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9b8b0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed32f0ee0d045c5981a8e7f762cc3293df1a6440b127dc65d3b6951551b72e59
Instruction ID: 5c8b96ac16d2ad7f010e9d856dcad4e153271735f96a20f35f43c97bf5bfda51
Opcode Fuzzy Hash: ed32f0ee0d045c5981a8e7f762cc3293df1a6440b127dc65d3b6951551b72e59
Instruction Fuzzy Hash: BA016D12B1EAA94FF351737868215727FF0CB9A260B0905B7F888CA0A7E8085A4143D2

Analysis Process: XClient.exePID: 6496, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A0C5E Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2150bcad261736f9877ed4f9918bf52681024abcd03b1a6b91c75c135606c095
Instruction ID: 426aebd77ad2b3f55cad0f7f19d326d5e6780001668c67992bb956d25ae8b338
Opcode Fuzzy Hash: 2150bcad261736f9877ed4f9918bf52681024abcd03b1a6b91c75c135606c095
Instruction Fuzzy Hash: 1562F861B29A494FE768FB7C887567DB6D2FF98300F4505BDE05EC32D6DE28A8428341

Function 00007FFD9B8A0730 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66672ab6aff8db00457340c4b6bb7b3d45c7e049cd0bbbd5b3de90e357bebf4
Instruction ID: d7d7438648adbc74ab14e1adf56b051a6e9155529f897926bbc7988a0e94dd97
Opcode Fuzzy Hash: b66672ab6aff8db00457340c4b6bb7b3d45c7e049cd0bbbd5b3de90e357bebf4
Instruction Fuzzy Hash: 74514861B0855A8BD30DBB68BC758EC7F61EF4431479941F6D05DC32CBED3824428B82

Function 00007FFD9B8A07A8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8507986f123b66c3b2081a7af92c66bb17e05ebc8673a674a25f8c0da04d1ed
Instruction ID: 686d92cb759ba4e575bcc2117e76b31ac9f1ea2283d9dc513c5e826a395c8334
Opcode Fuzzy Hash: c8507986f123b66c3b2081a7af92c66bb17e05ebc8673a674a25f8c0da04d1ed
Instruction Fuzzy Hash: FA31D420748A494FD75CEB28A8B08ADBF75EF88200BD544A9D01AC33CADE3468458B52

Function 00007FFD9B8A17E1 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e4790ada01148677f8fe9a11dc53057a7472d94e0bc9c69989e66e7bde5e76
Instruction ID: 44506cd5678a768a9f31ff26d4c7fd4fe75fa480439bd8d734fd3ba7b79dc347
Opcode Fuzzy Hash: e2e4790ada01148677f8fe9a11dc53057a7472d94e0bc9c69989e66e7bde5e76
Instruction Fuzzy Hash: A051F110B1E6C90FD796AB784875675AFD1DF8B219B0900FBE099C71EBDD185806C352

Function 00007FFD9B8A04E0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b957b077887ba727d7db1f8d1f3981daf4c663712164d1fd5374f25c445f5084
Instruction ID: 9d95a7a74ce7a3294259f842e10476a7cebe42f602b35401839ed8281955153d
Opcode Fuzzy Hash: b957b077887ba727d7db1f8d1f3981daf4c663712164d1fd5374f25c445f5084
Instruction Fuzzy Hash: FB31D921B189490FDB98FB2C587A679A7C1EF9D315F0505BEE01EC32EBDE689C418341

Function 00007FFD9B8A09A9 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb130fe91c820b28042e938445aaeed8dbee0941b89d3c2c467caec3e1d359e
Instruction ID: 150d7013b7f407781f293610b667b41d2a4cd25810eda2b988d8fa95e02de357
Opcode Fuzzy Hash: 1bb130fe91c820b28042e938445aaeed8dbee0941b89d3c2c467caec3e1d359e
Instruction Fuzzy Hash: E341A330B18A0D8FDB48EBA89861AFD7BB1FF98300F9545B9D019D32D6DE38A841C751

Function 00007FFD9B8A0B48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68f39ef713b8b6c935d6a740e7b18b37b3ba00f12b98bb8d7cc9dfe7d5bd1b9
Instruction ID: 5965552b2b8381a4d713dcbeac19efb028c121aecb11e7b0a161cbb598113909
Opcode Fuzzy Hash: d68f39ef713b8b6c935d6a740e7b18b37b3ba00f12b98bb8d7cc9dfe7d5bd1b9
Instruction Fuzzy Hash: 87212761F149094BFB88BBBC586A7FC72D2EF98715F10417AE51DC32DADD28A8428351

Function 00007FFD9B8A1981 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3558151493.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbb7f509d98e702b886392a977c44609bb65a540c81caf30944f369a0b87908
Instruction ID: c8f2625205274d8f2db1a326cbd929affc071e520b9701cb736ab23b89961f69
Opcode Fuzzy Hash: ebbb7f509d98e702b886392a977c44609bb65a540c81caf30944f369a0b87908
Instruction Fuzzy Hash: AF018912B0E6490EF354772828615717BE0CB97220B0D05BBE888C60E7E8085A41C3A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XClient.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

C:\Users\user\AppData\Roaming\XClient.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
XClient.exe

Function 00007FFD9B88CDF4 Relevance: 2.4, Strings: 1, Instructions: 1132
COMMON

Function 00007FFD9B8805B8 Relevance: 1.0, Instructions: 1000
COMMON

Function 00007FFD9B889566 Relevance: .5, Instructions: 472
COMMON

Function 00007FFD9B88A312 Relevance: .5, Instructions: 458
COMMON

Function 00007FFD9B883A68 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre