Edit tour

Windows Analysis Report
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Overview

General Information

Sample name:	17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe
Analysis ID:	1587331
MD5:	d7edb2f9bd829d3177dafbbae2e1ab6f
SHA1:	bf8fdcda459d9b9ada2ace6877e5b00a24db617e
SHA256:	7bb9c8a49a6734d2c337285564566120807b5e85c78f6eae8c3a0ffc4c882213
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe" MD5: D7EDB2F9BD829D3177DAFBBAE2E1AB6F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6417:$str01: $VB$Local_Port 0x6408:$str02: $VB$Local_Host 0x670c:$str03: get_Jpeg 0x60c7:$str04: get_ServicePack 0x715a:$str05: Select * from AntivirusProduct 0x7358:$str06: PCRestart 0x736c:$str07: shutdown.exe /f /r /t 0 0x741e:$str08: StopReport 0x73f4:$str09: StopDDos 0x74f6:$str10: sendPlugin 0x76a2:$str12: -ExecutionPolicy Bypass -File " 0x77cb:$str13: Content-length: 5235
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a38:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e6:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7838:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x78d5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x79ea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x74e6:$cnc4: POST / HTTP/1.1
00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe PID: 7128	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6417:$str01: $VB$Local_Port 0x6408:$str02: $VB$Local_Host 0x670c:$str03: get_Jpeg 0x60c7:$str04: get_ServicePack 0x715a:$str05: Select * from AntivirusProduct 0x7358:$str06: PCRestart 0x736c:$str07: shutdown.exe /f /r /t 0 0x741e:$str08: StopReport 0x73f4:$str09: StopDDos 0x74f6:$str10: sendPlugin 0x76a2:$str12: -ExecutionPolicy Bypass -File " 0x77cb:$str13: Content-length: 5235
0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a38:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e6:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:29.717657+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:40.565114+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:44.461065+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:59.226839+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:10.588541+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:13.977555+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:28.727222+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:37.148426+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:37.248985+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:40.591447+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:47.320543+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:47.412892+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.431339+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.530787+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.629806+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.728771+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.928258+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:58.032178+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:58.667936+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.578092+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.797970+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.210800+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.804511+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.903973+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:12.804282+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:12.906223+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.243294+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.332473+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.426310+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.525631+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.625435+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:15.475671+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:30.132065+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:37.929577+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:40.582574+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.444894+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.538142+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.614472+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.714108+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.813756+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:54.023401+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:54.439652+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:55.321103+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:57.460689+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.492233+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.584704+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.684567+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:07.383152+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:10.570196+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.306197+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.398576+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.498037+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.635705+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:24.213376+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:27.332057+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:40.582254+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:41.101640+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:42.993122+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:43.097946+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.491331+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.590988+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.690564+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.789798+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:57.023148+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:57.913893+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:58.228357+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:01.243897+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:06.164286+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:08.295941+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:10.583468+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:11.601420+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.585735+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.685839+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.903890+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:16.913719+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:29.772872+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:50:44.463087+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:50:59.229730+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:13.979670+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:28.740868+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:37.151651+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:37.251518+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.324620+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.445944+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.546438+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.551431+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.433457+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.578094+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.631545+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.730971+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.830937+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.838170+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.934747+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:58.042961+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:58.677779+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:11.213083+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:11.806721+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:11.906431+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:12.808931+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:12.909683+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.245401+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.334558+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.428381+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.527772+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.627676+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.754477+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:15.477961+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:30.141988+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:37.932049+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.448189+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.539947+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.616559+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.716295+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.815489+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.918869+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.926014+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.934052+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:54.035294+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:54.448749+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:55.323602+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:57.503350+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.501132+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.587124+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.686847+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:07.385875+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.309273+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.400710+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.500696+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.637478+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:24.216098+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:27.334503+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:41.107047+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:43.000696+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:43.099976+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.493672+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.593258+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.692392+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.791677+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:57.025676+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:57.915848+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:58.232476+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:01.512682+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:06.169367+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:08.301261+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:11.603525+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.588487+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.688052+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.906210+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:16.914636+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:50:40.565114+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:10.588541+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:40.591447+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.578092+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.797970+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:40.582574+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:10.570196+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:40.582254+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:10.583468+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.5	49715	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T07:51:57.641011+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.5	49715	87.120.116.179	1300	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	ReversingLabs: Detection: 84%
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: 87.120.116.179
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: 1300
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: <123456789>
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: 09-01-25
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	String decryptor: USB.exe

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49715 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 87.120.116.179:1300 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:49715 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 87.120.116.179:1300 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49715 -> 87.120.116.179:1300

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.116.179

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 87.120.116.179:1300

Source: Joe Sandbox View

IP Address: 87.120.116.179 87.120.116.179

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, 00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Malicious sample detected (through community Yara rule)

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF848846716	0_2_00007FF848846716
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF8488474C2	0_2_00007FF8488474C2
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF848842800	0_2_00007FF848842800

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, 00000000.00000000.2147781006.0000000000EAC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproblema.exe4 vs 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Binary or memory string: OriginalFilenameproblema.exe4 vs 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\EV6OqLeL7a2Ronpg

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	ReversingLabs: Detection: 84%
Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Virustotal: Detection: 70%

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF8488429FA push eax; iretd	0_2_00007FF848842A11
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF848842858 pushad ; retf	0_2_00007FF8488429D1
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Code function: 0_2_00007FF848842858 push eax; iretd	0_2_00007FF848842A11

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Memory allocated: 2E90000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Memory allocated: 1B080000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Window / User API: threadDelayed 9115			Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	Window / User API: threadDelayed 724			Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe TID: 5900	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe TID: 6620	Thread sleep count: 9115 > 30	Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe TID: 6620	Thread sleep count: 724 > 30	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, 00000000.00000002.4603422911.000000001C010000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Queries volume information: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, 00000000.00000002.4600944566.0000000001386000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe PID: 7128, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe PID: 7128, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	232 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	232 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	84%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	71%	Virustotal		Browse
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	100%	Avira	TR/Spy.Gen
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
87.120.116.179	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
87.120.116.179	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe, 00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.116.179	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587331
Start date and time:	2025-01-10 07:49:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50, 40.126.32.136
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Simulations

Behavior and APIs

Time	Type	Description
01:50:13	API Interceptor	14047168x Sleep call for process: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
87.120.116.179	17363482243fcf48f1d103ef5a4702c871424ad69b9eb7d3f5e5957f5c4810f2a51fea8e76776.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	17363364631bc7418009f735fbf6670730f0df5be418dd7fb7bf7e79b36349f3b17d812142896.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	173349054689897a42ce4a1face346760a1e1ea6ee459f1c43651627f7c7690c5adf7c1298500.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	173347741090e23c9ebd2c4b604c71623763cbce99aec650e3f9e27d35f4f3dcf6f1064415652.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	17334774117b7343420a7b9efab7c5b1abd0627c7af1c91f9947163684497ce841bf5f9198533.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	17334769266ba75a70859e94894e9fae5c33bba300e2b004c1166d236dc1ab2c8ff5669916631.dat-decoded.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	Material Requirments.pif.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	87.120.116.245
	Material requirements_1.pif.exe	Get hash	malicious	Remcos	Browse	87.120.116.245
	17363482243fcf48f1d103ef5a4702c871424ad69b9eb7d3f5e5957f5c4810f2a51fea8e76776.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179
	17363364631bc7418009f735fbf6670730f0df5be418dd7fb7bf7e79b36349f3b17d812142896.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179
	Inquiry List.doc	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	87.120.126.5
	XClient.exe	Get hash	malicious	XWorm	Browse	87.120.125.47
	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	87.120.113.91
	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	87.120.115.216

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.611655998985715
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe
File size:	36'864 bytes
MD5:	d7edb2f9bd829d3177dafbbae2e1ab6f
SHA1:	bf8fdcda459d9b9ada2ace6877e5b00a24db617e
SHA256:	7bb9c8a49a6734d2c337285564566120807b5e85c78f6eae8c3a0ffc4c882213
SHA512:	8fe98cd0e925f4e5a661cfc40a8e77caca9905d90b66a47e735ca21bae67b879ea2e6e8ba1288714534d7b7178ecf741a79546c385b00add1fe12a526b34d104
SSDEEP:	768:OL13A5Uno9RfHWa2BLyeo8icH1bxbFb9EPOMh9QXvO:4xA5Uno9JHWX+eNicH1bBFb9EPOMz6O
TLSH:	4FF24C48BBE04216D9ED6BF5A97372020274E613D917EB4E4CD48AD76F27BC48D013EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K..g................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40a5ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677FC34B [Thu Jan 9 12:38:35 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa598	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85f4	0x8600	c6cafffae732f8047c6132c24f143f1a	False	0.49903801305970147	data	5.747106887306253	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4e0	0x600	e5d58183f8f460c6f660033d5a3ee884	False	0.375	data	3.7166150004354077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	fd3ac7fbb8a34dc91e775b7c64e87bbc	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x24c	data			0.467687074829932
RT_MANIFEST	0xc2f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T07:50:29.538989+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:50:29.717657+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:29.772872+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:50:40.565114+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:40.565114+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:44.461065+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:44.463087+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:50:59.226839+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:50:59.229730+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:10.588541+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:10.588541+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:13.977555+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:13.979670+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:28.727222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:28.740868+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:37.148426+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:37.151651+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:37.248985+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:37.251518+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:40.591447+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:40.591447+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:47.320543+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:47.324620+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.412892+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:47.445944+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.546438+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:47.551431+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.431339+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.433457+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.530787+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.578094+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.629806+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.631545+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.641011+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.728771+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.730971+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.830937+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.838170+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:57.928258+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:57.934747+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:58.032178+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:58.042961+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:51:58.667936+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:51:58.677779+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:10.578092+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.578092+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.797970+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:10.797970+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.210800+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.213083+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:11.804511+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.806721+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:11.903973+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:11.906431+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:12.804282+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:12.808931+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:12.906223+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:12.909683+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.243294+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.245401+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.332473+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.334558+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.426310+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.428381+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.525631+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.527772+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.625435+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:13.627676+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:13.754477+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:15.475671+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:15.477961+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:30.132065+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:30.141988+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:37.929577+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:37.932049+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:40.582574+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:40.582574+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.444894+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.448189+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.538142+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.539947+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.614472+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.616559+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.714108+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.716295+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.813756+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:49.815489+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.918869+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.926014+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:49.934052+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:54.023401+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:54.035294+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:54.439652+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:54.448749+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:55.321103+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:55.323602+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:52:57.460689+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:52:57.503350+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.492233+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.501132+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.584704+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.587124+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:05.684567+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:05.686847+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:07.383152+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:07.385875+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:10.570196+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:10.570196+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.306197+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.309273+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.398576+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.400710+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.498037+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.500696+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:21.635705+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:21.637478+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:24.213376+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:24.216098+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:27.332057+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:27.334503+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:40.582254+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:40.582254+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:41.101640+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:41.107047+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:42.993122+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:43.000696+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:43.097946+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:43.099976+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.491331+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.493672+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.590988+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.593258+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.690564+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.692392+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:47.789798+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:47.791677+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:57.023148+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:57.025676+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:57.913893+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:57.915848+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:53:58.228357+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:53:58.232476+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:01.243897+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:01.512682+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:06.164286+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:06.169367+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:08.295941+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:08.301261+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:10.583468+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:10.583468+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:11.601420+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:11.603525+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.585735+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.588487+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.685839+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.688052+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:13.903890+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:13.906210+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP
2025-01-10T07:54:16.913719+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.5	49715	TCP
2025-01-10T07:54:16.914636+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49715	87.120.116.179	1300	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 07:50:14.577109098 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:14.581937075 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:14.582060099 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:14.785727978 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:14.790558100 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:29.538989067 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:29.544063091 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:29.717657089 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:29.765738964 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:29.772871971 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:29.777715921 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:40.565114021 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:40.609522104 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:44.282058001 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:44.286942959 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:44.461065054 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:44.463087082 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:44.467888117 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:59.048437119 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:59.053380013 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:59.226839066 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:50:59.229729891 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:50:59.234668016 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:10.588541031 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:10.640758038 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:13.797564030 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:13.803136110 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:13.977555037 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:13.979670048 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:13.984536886 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:28.547391891 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:28.552237988 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:28.727221966 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:28.740868092 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:28.745769978 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:36.969357014 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:36.974129915 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:37.016231060 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:37.021060944 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:37.148426056 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:37.151650906 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:37.156533003 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:37.248985052 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:37.251518011 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:37.256318092 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:40.591447115 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:40.640969038 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.141206026 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.146040916 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.156966925 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.162019968 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.172312975 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.177267075 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.187958956 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.194726944 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.320543051 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.324620008 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.329438925 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.412892103 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.445944071 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.450860977 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.543410063 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.546437979 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.551372051 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:47.551430941 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:47.556253910 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.250608921 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.255505085 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.266138077 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.272317886 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.281639099 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.286537886 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.375463963 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.380343914 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.431339025 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.433456898 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.438357115 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.469247103 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.474118948 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.484797955 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.489671946 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.530786991 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.532474041 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.578033924 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.578094006 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.582940102 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.629806042 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.631545067 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.636329889 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.641011000 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.645876884 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.728770971 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.730971098 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.735831976 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.828174114 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.830936909 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.835839033 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.838170052 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.842986107 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.928257942 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:57.934746981 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:57.939651012 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:58.032177925 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:58.042960882 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:58.048297882 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:58.485049963 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:58.489999056 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:58.667936087 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:51:58.677778959 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:51:58.682698965 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:10.578092098 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:10.797970057 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:10.801856995 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.031750917 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.036881924 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.210799932 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.213083029 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.217890978 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.625613928 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.630481958 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.657191038 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.661943913 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.804511070 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.806720972 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.811564922 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.903973103 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:11.906430960 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:11.911256075 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.625448942 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:12.630357981 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.696944952 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:12.701756954 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.804281950 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.808931112 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:12.813844919 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.906223059 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:12.909682989 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:12.914556026 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.016210079 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.021194935 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.094300985 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.099240065 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.125948906 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.130923986 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.188201904 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.193109989 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.235131979 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.240056992 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.243294001 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.245400906 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.294090986 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.328954935 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.332473040 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.333856106 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.334558010 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.339397907 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.345000982 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.349817991 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.360938072 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.365874052 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.426310062 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.428380966 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.433271885 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.525630951 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.527771950 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.532934904 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.625435114 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.627676010 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.632599115 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.725008011 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.754477024 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.759383917 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:13.759464025 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:13.764343977 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:15.203814030 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:15.315304995 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:15.475671053 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:15.477961063 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:15.482721090 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:29.953568935 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:29.958504915 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:30.132065058 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:30.141988039 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:30.146835089 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:37.750370026 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:37.755310059 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:37.929577112 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:37.932049036 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:37.936862946 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:40.582573891 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:40.625125885 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.266165018 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.271079063 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.281724930 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.286669016 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.391071081 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.396049023 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.444894075 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.448189020 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.453057051 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.484935045 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.489901066 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.516005993 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.520936966 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.531547070 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.537260056 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.538141966 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.539947033 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.586007118 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.586095095 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.590919018 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.614471912 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.616559029 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.662054062 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.714107990 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.716295004 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.721241951 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.813755989 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.815489054 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.820362091 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.913033962 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.918869019 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.923830986 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.926013947 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.930880070 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:49.934051991 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:49.938927889 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:53.844435930 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:53.849442005 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:54.023401022 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:54.035294056 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:54.040321112 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:54.189084053 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:54.194133043 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:54.439651966 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:54.448749065 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:54.453680992 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:55.141319036 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:55.146363020 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:55.321103096 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:55.323601961 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:55.328481913 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:57.282068014 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:57.286993027 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:57.460689068 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:52:57.503350019 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:52:57.508299112 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.312963009 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.317967892 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.344162941 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.349155903 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.359848976 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.364635944 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.492233038 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.501132011 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.506330967 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.584703922 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.587124109 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.592060089 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.684566975 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:05.686846972 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:05.691792011 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:07.203983068 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:07.208961964 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:07.383152008 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:07.385874987 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:07.390806913 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:10.570195913 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:10.782788038 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.109946966 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.115025043 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.141231060 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.146155119 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.266144991 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.271092892 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.306196928 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.309273005 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.358037949 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.359986067 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.364940882 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.398576021 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.400710106 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.446042061 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.498037100 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.500695944 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.505614042 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.635704994 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:21.637478113 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:21.642445087 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:24.033191919 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:24.038218021 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:24.213376045 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:24.216098070 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:24.221860886 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:27.109827042 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:27.114762068 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:27.332056999 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:27.334502935 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:27.339411020 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:40.582253933 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:40.625140905 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:40.922935963 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:40.928194046 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:41.101639986 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:41.107047081 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:41.114569902 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:42.813868999 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:42.818962097 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:42.828928947 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:42.833729029 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:42.993122101 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:43.000695944 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:43.005598068 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:43.097945929 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:43.099976063 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:43.104932070 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.313127041 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.318085909 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.360045910 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.364955902 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.406874895 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.411863089 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.422470093 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.427416086 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.491331100 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.493671894 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.498564959 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.590987921 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.593257904 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.598138094 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.690563917 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.692392111 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.697310925 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.789798021 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:47.791676998 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:47.796540022 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:56.844347000 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:56.849343061 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:57.023148060 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:57.025676012 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:57.030580997 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:57.735001087 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:57.739898920 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:57.913892984 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:57.915848017 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:57.920722961 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:58.047442913 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:58.052437067 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:58.228357077 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:53:58.232475996 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:53:58.237309933 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:01.065080881 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:01.069998980 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:01.243896961 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:01.343907118 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:01.512681961 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:01.519063950 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:05.984968901 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:05.990040064 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:06.164285898 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:06.169367075 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:06.174293041 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:08.110215902 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:08.115349054 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:08.295941114 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:08.301260948 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:08.306250095 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:10.583467960 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:10.642880917 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:11.422513008 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:11.427408934 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:11.601419926 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:11.603524923 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:11.608374119 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.406821966 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.411912918 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.422283888 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.427290916 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.585735083 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.588486910 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.593394041 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.672872066 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.677866936 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.685838938 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.688051939 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.734035015 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.903889894 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:13.906209946 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:13.911168098 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:16.734891891 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:16.739865065 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:16.913718939 CET	1300	49715	87.120.116.179	192.168.2.5
Jan 10, 2025 07:54:16.914635897 CET	49715	1300	192.168.2.5	87.120.116.179
Jan 10, 2025 07:54:16.919466972 CET	1300	49715	87.120.116.179	192.168.2.5

Analysis Process: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exePID: 7128, Parent PID: 1028

General

Target ID:	0
Start time:	01:50:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe"
Imagebase:	0xea0000
File size:	36'864 bytes
MD5 hash:	D7EDB2F9BD829D3177DAFBBAE2E1AB6F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2147758981.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4601622919.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exePID: 7128, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848842800 Relevance: 2.4, Strings: 1, Instructions: 1140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF84884B1A0

Memory Dump Source

Source File: 00000000.00000002.4604508052.00007FF848840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848840000_17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc260.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: afcaae2e0464c6515dc0cea222cd056a2c03ba7d2d0e80c76ad109b0c0c68d2e
Instruction ID: 71500e9a44016822675146091189155aa4425d414a7ec2b43d78d0a936b99896
Opcode Fuzzy Hash: afcaae2e0464c6515dc0cea222cd056a2c03ba7d2d0e80c76ad109b0c0c68d2e
Instruction Fuzzy Hash: 3F726C31F1C90A8FEA94FB38845A67972D2EFD8794F5445B9D40EC7287EE2CE8428744

Function 00007FF848846716 Relevance: .5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4604508052.00007FF848840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848840000_17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc260.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4be0c8c75debd8060072ef353f1242e5f86aa917e69caa42e438dbfe29a235
Instruction ID: 58326ff02ff35bba981531264df61d99fbd12c9a45c865fec718eb0f7679a2d6
Opcode Fuzzy Hash: ed4be0c8c75debd8060072ef353f1242e5f86aa917e69caa42e438dbfe29a235
Instruction Fuzzy Hash: 4DF1B431A0CA8D8FEBA8EF28C8557E93BD1FF54750F04426EE84DC7291DB7499458B82

Function 00007FF8488474C2 Relevance: .5, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4604508052.00007FF848840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848840000_17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc260.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb5ecd909439467dbb9496f5760fe2218a0a1681b9c9ee4ce8105f19382fa08
Instruction ID: d113d7c11588eb6d8500f4acf4c3b678b28c9c71c5ddd6474afe36ab2be3c412
Opcode Fuzzy Hash: eeb5ecd909439467dbb9496f5760fe2218a0a1681b9c9ee4ce8105f19382fa08
Instruction Fuzzy Hash: A6E1C131A0CA8E8FEBA8EF28C8557E937D1EF54750F14426ED84DC7291DF78A8418B81

Function 00007FF848841BE8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF848841CB1

Memory Dump Source

Source File: 00000000.00000002.4604508052.00007FF848840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848840000_17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc260.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 6758a7a23dba172565a1e8867c4f1373cea547849065fa92451598ac6cd16fa2
Instruction ID: fa9ddc25f400da96e8b75981ca1036db012ea94887c26581902bdedfdae261a5
Opcode Fuzzy Hash: 6758a7a23dba172565a1e8867c4f1373cea547849065fa92451598ac6cd16fa2
Instruction Fuzzy Hash: B5412631A1CA5D4FDB18EF6CD8466F9BBE1EF59311F00427ED009C3292DA64A852C7C5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
17364916859ea2c227941e63335bcf02a749f58a3f6d7a5fc5312d32a2ea1c4a4cc26022a4160.dat-decoded.exe

Function 00007FF848842800 Relevance: 2.4, Strings: 1, Instructions: 1140
COMMON

Function 00007FF848846716 Relevance: .5, Instructions: 474
COMMON

Function 00007FF8488474C2 Relevance: .5, Instructions: 460
COMMON

Function 00007FF848841BE8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON