Edit tour
Windows
Analysis Report
87.247.158.212 (3).ps1
Overview
General Information
| Sample name: | 87.247.158.212 (3).ps1 |
| Analysis ID: | 1591123 |
| MD5: | 4b3210cb8e8302866bf06ad0fe25f2b9 |
| SHA1: | 66616780ec89b1df891484e0a783bfe31071f953 |
| SHA256: | 09dd3ed3ecfe134067a2f8b6640cfbc3c3b702a0714328856d2f6b7459342048 |
| Tags: | 87-247-158-212ps1user-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected XWorm
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Potentially Suspicious Malware Callback Communication
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
powershell.exe (PID: 6948 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\87. 247.158.21 2 (3).ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6964 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
RegSvcs.exe (PID: 3752 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Svcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94) 
WerFault.exe (PID: 2848 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 3 752 -s 131 2 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{
"C2 url": [
"87.247.158.212"
],
"Port": 4444,
"Aes key": "P0WER",
"SPL": "<Xwormmm>",
"Install file": "USB.exe"
}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Click to see the 6 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 10 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: frack113: | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-14T17:59:27.319937+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:28.733731+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:39.642471+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:50.543453+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:57.323364+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:02.201831+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:12.464604+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:23.442141+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:27.320326+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:34.347130+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:35.231131+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:40.668988+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:40.790695+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:51.636290+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:57.325493+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:01:06.983627+0100 | 2852870 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-14T17:59:28.735711+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:39.644703+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:50.545923+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:02.203558+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:12.467870+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:23.445398+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:34.353685+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:35.234970+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:40.671309+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:40.792781+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:01:06.770546+0100 | 2852923 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-14T17:59:27.319937+0100 | 2858801 | 1 | Malware Command and Control Activity Detected | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-14T17:59:28.514727+0100 | 2858800 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
- • AV Detection
- • Compliance
- • Networking
- • Key, Mouse, Clipboard, Microphone and Screen Capturing
- • System Summary
- • Data Obfuscation
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
- • Lowering of HIPS / PFW / Operating System Security Settings
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Window created: | Jump to behavior | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_00007FFD9AFD4A70 | |
| Source: | Code function: | 0_2_00007FFD9AFD513C | |
| Source: | Code function: | 2_2_029F6340 | |
| Source: | Code function: | 2_2_029FB178 | |
| Source: | Code function: | 2_2_029F84B8 | |
| Source: | Code function: | 2_2_029F5A70 | |
| Source: | Code function: | 2_2_029FBEB8 | |
| Source: | Code function: | 2_2_029F5728 | |
| Source: | Code function: | 2_2_029F0FA0 | |
| Source: | Process created: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00007FFD9AFD4C0D | |
| Source: | Code function: | 0_2_00007FFD9AFD00C1 | |
| Source: | Code function: | 0_2_00007FFD9AFDA8DD | |
| Source: | Code function: | 0_2_00007FFD9AFDBC8D | |
| Source: | Code function: | 2_2_029F8081 | |
| Source: | Code function: | 2_2_029F4CD1 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 DLL Side-Loading | 212 Process Injection | 1 Disable or Modify Tools | OS Credential Dumping | 131 Security Software Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 131 Virtualization/Sandbox Evasion | LSASS Memory | 2 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 212 Process Injection | Security Account Manager | 131 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 13 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 26% | Virustotal | Browse | ||
| 26% | ReversingLabs | Script-PowerShell.Trojan.LummaC |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 87.247.158.212 | unknown | Russian Federation | 49505 | SELECTELRU | true |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1591123 |
| Start date and time: | 2025-01-14 17:58:06 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 39s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 87.247.158.212 (3).ps1 |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winPS1@5/10@0/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, W erFault.exe, WMIADAP.exe, SIHC lient.exe, conhost.exe, svchos t.exe - Excluded IPs from analysis (wh
itelisted): 20.42.73.29, 20.10 9.210.53, 13.107.246.45, 4.245 .163.56, 40.126.31.71 - Excluded domains from analysis
(whitelisted): ocsp.digicert. com, slscr.update.microsoft.co m, otelrules.azureedge.net, lo gin.live.com, blobcollector.ev ents.data.trafficmanager.net, onedsblobprdeus15.eastus.cloud app.azure.com, ctldl.windowsup date.com, umwatson.events.data .microsoft.com, fe3cr.delivery .mp.microsoft.com - Execution Graph export aborted
for target RegSvcs.exe, PID 3 752 because it is empty - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtSetInformationFile c alls found.
| Time | Type | Description |
|---|---|---|
| 11:59:12 | API Interceptor | |
| 11:59:16 | API Interceptor | |
| 12:01:06 | API Interceptor |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SELECTELRU | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
⊘No context
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.1748666313396363 |
| Encrypted: | false |
| SSDEEP: | 192:kKbzk8QX6/0BU/SaaTHy8SkmzuiFNZ24IO8a:dbxQXhBU/Sa2Sz9zuiFNY4IO8a |
| MD5: | 629D7B77BA2C046BC7DF76B51F6243CD |
| SHA1: | F8EEE2C650C35C9DA924D087DC3B256C59AAB083 |
| SHA-256: | 34535FFC7095934B5C0B77B6F7B14818927341B1D38335072D5BF9A7041672AC |
| SHA-512: | 0AD9DFB99728EA9DD8CAF5ABDF95B7D5312D219FF8704EA8688DB9985AD4BF6FF3D2299F43F24DD5FB056F77834DD5480415BB40106A5B76622A4B2D1C3AEE31 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 311647 |
| Entropy (8bit): | 3.5798712432423483 |
| Encrypted: | false |
| SSDEEP: | 3072:0lkgWLP4uEq5fCFKyfALTgDOx2sPCYqd9uh36:0er4w6oy+TgDWP8uY |
| MD5: | DA1345526930995F22E2685B60381F30 |
| SHA1: | 1F8DF1A5797DD0E6F2D0EFA96B2ABD62066E1216 |
| SHA-256: | 3AA48D6A7AEDC7B14A2898D089DE87352E0747A444BC0B77B6B049FFA3893AA1 |
| SHA-512: | C97DA4E68A40317FEDAB254ADBA033764BAA6C1FAD90B884E10A2218AFC0C9AE601F9BE3C11A46777F2C480E428D26D68023562FA4C0095150DFD928CCF9C6DC |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8350 |
| Entropy (8bit): | 3.6945158465224037 |
| Encrypted: | false |
| SSDEEP: | 192:R6l7wVeJX26JaM6YRQpS1gmfZA8prg89bBEsfcqhrm:R6lXJG6JaM6YCpS1gmfaMB3fcqw |
| MD5: | B529624317EDE0F1962B4410DEE3D83E |
| SHA1: | 1987971B30768493B0547C6B2D8158D3EB553552 |
| SHA-256: | 69662478C26793505738F6ED8D88CBB10301B74081C3DF6F0775EA404D04C9D0 |
| SHA-512: | E41EBDF16D430900AE4D519523FF106F17A37088DFCB42A742F9E3E657249C3A80F1BF7C6E7F8026B66EAFE470217DA666DC40CB2EEC72DE870A1180DE7D1A46 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4726 |
| Entropy (8bit): | 4.449345651038675 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zs1Jg77aI938WpW8VYGYm8M4JdYFM+q8vmgmDIfd:uIjfPI7x17VaJTKPmDIfd |
| MD5: | B9480D3E4D3EE407FEDAB1001C0518AF |
| SHA1: | 3FFBE6076DC1EE6A69B54C5D16BCFF55F2CEDABB |
| SHA-256: | 86058DB79776DE6D4B4299C3F2D81D3489D9E7C65A2386B38C044730A4011F72 |
| SHA-512: | CECF4F5E8B47681436FFFE8586A78F333EA9E371897E0DF69BA78014B995716BA78E2FCE8902EE9151D35E4D369F769EFFA844591AF580E184956B834554F97F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 1.1628158735648508 |
| Encrypted: | false |
| SSDEEP: | 3:NlllulFgtj:NllUa |
| MD5: | E986DDCA20E18C878305AA21342325F6 |
| SHA1: | AE6890EE7BB81A051A4F4079F549DEBCCE0F82C9 |
| SHA-256: | 9624DAA47DF80C2229877179550D8373CAEEEAE25A8123698D7A516AD455DD15 |
| SHA-512: | 8B0CD5C1F0BAECA299669D6A0CB74F9315E90B05EDEA16C92B92D9927D3D07225AC5DAE9941CF339E1CED349BA8129F56F118CF89AB86CF8DAAAFFDB8EC8B56D |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.720367661421551 |
| Encrypted: | false |
| SSDEEP: | 96:3Gt33CxHskkvhkvCCtLGFa28HYGFa28He:3GtyMgLGoSGow |
| MD5: | 3DBB7FDF2593D63F124FF08D89F18DD7 |
| SHA1: | 408C20F23C26ED1369EC513E2DA995ED5AEE7EB3 |
| SHA-256: | 9A37BFA18FBA9253471568DF6E438039F875C684D4BE5AC90A52A5D91806A9B5 |
| SHA-512: | D4AD504CC28AF0CC466897B9110589BE7AB36F7567982B0256EDF83D1EE62F99724BBBDEA7727B6C811EE2394FF215BF1D9C0700D755DAF32687D7B12EA2BBD2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.720367661421551 |
| Encrypted: | false |
| SSDEEP: | 96:3Gt33CxHskkvhkvCCtLGFa28HYGFa28He:3GtyMgLGoSGow |
| MD5: | 3DBB7FDF2593D63F124FF08D89F18DD7 |
| SHA1: | 408C20F23C26ED1369EC513E2DA995ED5AEE7EB3 |
| SHA-256: | 9A37BFA18FBA9253471568DF6E438039F875C684D4BE5AC90A52A5D91806A9B5 |
| SHA-512: | D4AD504CC28AF0CC466897B9110589BE7AB36F7567982B0256EDF83D1EE62F99724BBBDEA7727B6C811EE2394FF215BF1D9C0700D755DAF32687D7B12EA2BBD2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.466339857038044 |
| Encrypted: | false |
| SSDEEP: | 6144:pIXfpi67eLPU9skLmb0b4QWSPKaJG8nAgejZMMhA2gX4WABl0uNfdwBCswSb+:aXD94QWlLZMM6YFHl++ |
| MD5: | C21B5EFABACF7A83F7220087012A8B2D |
| SHA1: | F0218E846F130EF3573480DCAD7FD60DB78C8193 |
| SHA-256: | 948FD5BBE3C35B4BAAE052D072048AC6404F2E5110AF210D099863F4C9DF41A2 |
| SHA-512: | 683470150C01EB7D0EF33DC3300E39D65BEEA315D2F12AAB1BA0CA4C712BE464B655C06841F400826E70DD3E3EDE5BBA30E969A00F4E589379887FBD80AEDE26 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.103249655449902 |
| TrID: | |
| File name: | 87.247.158.212 (3).ps1 |
| File size: | 181'457 bytes |
| MD5: | 4b3210cb8e8302866bf06ad0fe25f2b9 |
| SHA1: | 66616780ec89b1df891484e0a783bfe31071f953 |
| SHA256: | 09dd3ed3ecfe134067a2f8b6640cfbc3c3b702a0714328856d2f6b7459342048 |
| SHA512: | 70326d2d7ce7cf898f720c8f79ec30c2549f6b54d7a62af16a9075ceaf1df274f9f9981bdafd9378c404fec6293c132475ad6035597078090a5bfacd5caa7b32 |
| SSDEEP: | 3072:waQm6eceoU8jH/06kbaAiHnVExoyZYwOiY1LBSUkf2jFgdIVgMbJN+5PVu1Zhn6D:eVe/8jH/fkbaAiHnVExoyZYwOiY1LBSD |
| TLSH: | DF045B730103FC8B67BF3F89E5043AA51C68643B575E85A8F9C90AAD60EA510DF39DB4 |
| File Content Preview: | .. $t0='IQIQQIIQIQQEX'.replace('IQIQQ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAKcOfWcAAAAAAA |
 | |
| Icon Hash: | 3270d6baae77db44 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-14T17:59:27.319937+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:27.319937+0100 | 2858801 | ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:28.514727+0100 | 2858800 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:28.733731+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:28.735711+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:39.642471+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:39.644703+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:50.543453+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T17:59:50.545923+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T17:59:57.323364+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:02.201831+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:02.203558+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:12.464604+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:12.467870+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:23.442141+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:23.445398+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:27.320326+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:34.347130+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:34.353685+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:35.231131+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:35.234970+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:40.668988+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:40.671309+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:40.790695+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:40.792781+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:00:51.636290+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:00:57.325493+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| 2025-01-14T18:01:06.770546+0100 | 2852923 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) | 1 | 192.168.2.4 | 49730 | 87.247.158.212 | 4444 | TCP |
| 2025-01-14T18:01:06.983627+0100 | 2852870 | ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes | 1 | 87.247.158.212 | 4444 | 192.168.2.4 | 49730 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 14, 2025 17:59:17.510166883 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:17.514976978 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:17.515064955 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:17.616422892 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:17.621160984 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:27.319936991 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:27.370980978 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:28.514727116 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:28.519541979 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:28.733731031 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:28.735711098 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:28.740489006 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:39.418277979 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:39.482450008 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:39.642471075 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:39.644702911 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:39.649490118 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:50.324714899 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:50.329508066 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:50.543452978 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:50.545922995 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 17:59:50.551707029 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:57.323364019 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 17:59:57.371146917 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:01.350127935 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:01.356321096 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:02.201831102 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:02.203557968 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:02.208323002 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:12.246520042 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:12.251334906 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:12.464603901 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:12.467869997 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:12.472614050 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:23.223584890 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:23.228456974 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:23.442141056 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:23.445398092 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:23.450196981 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:27.320326090 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:27.371326923 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:34.128634930 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:34.133477926 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:34.347130060 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:34.353684902 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:34.358486891 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:35.012892962 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:35.017648935 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:35.231131077 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:35.234970093 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:35.239855051 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.449929953 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:40.454894066 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.496818066 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:40.501773119 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.668987989 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.671308994 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:40.677314997 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.790694952 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:40.792781115 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:40.797611952 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:51.408317089 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:51.413245916 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:51.636290073 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:51.684060097 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:00:57.325493097 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:00:57.371545076 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:01:06.764514923 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:01:06.769340038 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:01:06.770545959 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:01:06.775378942 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:01:06.983627081 CET | 4444 | 49730 | 87.247.158.212 | 192.168.2.4 |
| Jan 14, 2025 18:01:07.027815104 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
| Jan 14, 2025 18:01:13.098020077 CET | 49730 | 4444 | 192.168.2.4 | 87.247.158.212 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 11:59:09 |
| Start date: | 14/01/2025 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff788560000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 11:59:10 |
| Start date: | 14/01/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 11:59:13 |
| Start date: | 14/01/2025 |
| Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x7a0000 |
| File size: | 45'984 bytes |
| MD5 hash: | 9D352BC46709F0CB5EC974633A0C3C94 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 12:00:50 |
| Start date: | 14/01/2025 |
| Path: | C:\Windows\SysWOW64\WerFault.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x790000 |
| File size: | 483'680 bytes |
| MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
Execution Coverage
Dynamic/Packed Code Coverage
Signature Coverage
| Execution Coverage: | 2.8% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 5 |
| Total number of Limit Nodes: | 0 |
Graph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
