Edit tour
Windows
Analysis Report
XoilaFixer.exe
Overview
General Information
| Sample name: | XoilaFixer.exe |
| Analysis ID: | 1647480 |
| MD5: | cd3c6e9d220bc5f45ccdbc65958b4595 |
| SHA1: | 4b1c43a79d6f0827f87a797734ee2ec9cc361e17 |
| SHA256: | 42e006cd726aa80af62ca03f177476b7c592bce5a77a4b3a074abda88e3dbe5d |
| Tags: | exeuser-BastianHein |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 96 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains potential unpacker
Joe Sandbox ML detected suspicious sample
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Drops PE files
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
XoilaFixer.exe (PID: 7744 cmdline: "C:\Users\ user\Deskt op\XoilaFi xer.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- XoilaFixer.exe (PID: 7412 cmdline:
"C:\Users\ user\AppDa ta\Roaming \XoilaFixe r.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- XoilaFixer.exe (PID: 5348 cmdline:
"C:\Users\ user\AppDa ta\Roaming \XoilaFixe r.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Click to see the 6 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 10 entries | ||||
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
- • AV Detection
- • Compliance
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Boot Survival
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • Language, Device and Operating System Detection
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Code function: | 1_2_00007FF88B4E00C1 | |
| Source: | Code function: | 1_2_00007FF88B4E15AD | |
| Source: | Code function: | 8_2_00007FF88B4E00C1 | |
| Source: | Code function: | 10_2_00007FF88B4E00C1 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 11 Security Software Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | Security Account Manager | 13 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Process Injection | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | 3 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Obfuscated Files or Information | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 56% | Virustotal | Browse | ||
| 64% | ReversingLabs | ByteCode-MSIL.Trojan.Zilla | ||
| 100% | Avira | TR/Dropper.Gen |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/Dropper.Gen | ||
| 64% | ReversingLabs | ByteCode-MSIL.Trojan.Zilla |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| abolhb.com | 185.172.175.125 | true | false | high | |
| raw.githubusercontent.com | 185.199.111.133 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 185.199.111.133 | raw.githubusercontent.com | Netherlands | 54113 | FASTLYUS | false | |
| 185.172.175.125 | abolhb.com | Lithuania | 25780 | HUGESERVER-NETWORKSUS | false |
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1647480 |
| Start date and time: | 2025-03-24 22:03:15 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 12s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 13 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | XoilaFixer.exe |
| Detection: | MAL |
| Classification: | mal96.troj.evad.winEXE@3/3@2/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, d llhost.exe, SIHClient.exe, Sgr mBroker.exe, conhost.exe, svch ost.exe - Excluded IPs from analysis (wh
itelisted): 184.31.69.3, 20.10 9.210.53, 4.175.87.197 - Excluded domains from analysis
(whitelisted): fs.microsoft.c om, slscr.update.microsoft.com , ctldl.windowsupdate.com, fe3 cr.delivery.mp.microsoft.com - Execution Graph export aborted
for target XoilaFixer.exe, PI D 5348 because it is empty - Execution Graph export aborted
for target XoilaFixer.exe, PI D 7412 because it is empty - Execution Graph export aborted
for target XoilaFixer.exe, PI D 7744 because it is empty - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtQueryValueKey calls found. - Report size getting too big, t
oo many NtReadVirtualMemory ca lls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 17:05:10 | API Interceptor | |
| 22:04:12 | Autostart | |
| 22:04:20 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 185.199.111.133 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 185.172.175.125 | Get hash | malicious | XWorm | Browse | ||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse | |||
| Get hash | malicious | Njrat, XWorm | Browse | |||
| Get hash | malicious | Njrat | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| raw.githubusercontent.com | Get hash | malicious | LummaC Stealer, Salat Stealer | Browse |
| |
| Get hash | malicious | Quasar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| abolhb.com | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse |
| ||
| Get hash | malicious | Njrat, XWorm | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| FASTLYUS | Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| HUGESERVER-NETWORKSUS | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | LummaC Stealer, PureLog Stealer, XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse |
| ||
| Get hash | malicious | Amadey, SystemBC | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Kdot Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | CAPTCHA Scam ClickFix | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
⊘No context
| Process: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 654 |
| Entropy (8bit): | 5.380476433908377 |
| Encrypted: | false |
| SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT |
| MD5: | 30E4BDFC34907D0E4D11152CAEBE27FA |
| SHA1: | 825402D6B151041BA01C5117387228EC9B7168BF |
| SHA-256: | A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63 |
| SHA-512: | 89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA |
| Malicious: | true |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 50176 |
| Entropy (8bit): | 5.579413998347093 |
| Encrypted: | false |
| SSDEEP: | 768:nwj1+sT2ijuJ4lJ87040qY1guzb+MMyklxfr1puhJOWF82o9Ze:nwjzT2iL/q8rb+MM/2bOH9k |
| MD5: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| SHA1: | 4B1C43A79D6F0827F87A797734EE2EC9CC361E17 |
| SHA-256: | 42E006CD726AA80AF62CA03F177476B7C592BCE5A77A4B3A074ABDA88E3DBE5D |
| SHA-512: | 00A6980EF286A075F18927364D200645695CA3B8AB3660B92135DE61BA688B1717B193A5EC2B79A0AFD9910DB42573A9C19520FD2D9DD5176F7A13E5135C2C31 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.579413998347093 |
| TrID: |
|
| File name: | XoilaFixer.exe |
| File size: | 50'176 bytes |
| MD5: | cd3c6e9d220bc5f45ccdbc65958b4595 |
| SHA1: | 4b1c43a79d6f0827f87a797734ee2ec9cc361e17 |
| SHA256: | 42e006cd726aa80af62ca03f177476b7c592bce5a77a4b3a074abda88e3dbe5d |
| SHA512: | 00a6980ef286a075f18927364d200645695ca3b8ab3660b92135de61ba688b1717b193a5ec2b79a0afd9910db42573a9c19520fd2d9dd5176f7a13e5135c2c31 |
| SSDEEP: | 768:nwj1+sT2ijuJ4lJ87040qY1guzb+MMyklxfr1puhJOWF82o9Ze:nwjzT2iL/q8rb+MM/2bOH9k |
| TLSH: | AD33D7C9A3D50132C1FF5AB219F3520A92F4A593481AC75EBCD515DA3BA7BC88640FE3 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ........@.. ....................... ............@................................ |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x40d89e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x67E18AE7 [Mon Mar 24 16:40:07 2025 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xd850 | 0x4b | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xe000 | 0x5ca | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x10000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0xb8a4 | 0xba00 | fa2cf7d3d27950b16db0ceceb9d26120 | False | 0.435525873655914 | data | 5.663366865089623 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xe000 | 0x5ca | 0x600 | 3e2607ab137e445929296ac559c79835 | False | 0.4192708333333333 | data | 4.145944420748221 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x10000 | 0xc | 0x200 | 17acbfaf4a563f1c238819a61b0d67b2 | False | 0.044921875 | data | 0.08153941234324169 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0xe0a0 | 0x340 | data | 0.41466346153846156 | ||
| RT_MANIFEST | 0xe3e0 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5469387755102041 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
| Description | Data |
|---|---|
| Translation | 0x0000 0x04b0 |
| Comments | %Des% |
| CompanyName | %Company% |
| FileDescription | %Title% |
| FileVersion | 1.0.0.0 |
| InternalName | XoilaFixer.exe |
| LegalCopyright | %Copyright% |
| LegalTrademarks | %Trademark% |
| OriginalFilename | XoilaFixer.exe |
| ProductName | %Product% |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
- Total Packets: 47
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 24, 2025 22:04:10.226284027 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.226336956 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.226397991 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.244524956 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.244555950 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.449603081 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.449729919 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.454910994 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.454926014 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.455336094 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.510746002 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.519006014 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.560328960 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.751969099 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.752041101 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.752090931 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.752091885 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.752105951 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.752157927 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.755753040 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.759624958 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.759701014 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.759726048 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.763326883 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.763395071 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.763408899 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.768218040 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.768302917 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.768326044 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.772058964 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.772115946 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.772130013 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.776015043 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.776067972 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.776082039 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.783350945 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.783402920 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.783411026 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.783430099 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.783468008 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.786925077 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.789496899 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.789544106 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.789556026 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.789573908 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.789611101 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.792974949 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.793076038 CET | 443 | 49692 | 185.199.111.133 | 192.168.2.6 |
| Mar 24, 2025 22:04:10.793243885 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:10.807928085 CET | 49692 | 443 | 192.168.2.6 | 185.199.111.133 |
| Mar 24, 2025 22:04:16.850900888 CET | 49697 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:17.854492903 CET | 49697 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:19.854490995 CET | 49697 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:23.854552031 CET | 49697 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:31.870210886 CET | 49697 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:42.137192011 CET | 49705 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:43.151531935 CET | 49705 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:45.151489973 CET | 49705 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:49.167073965 CET | 49705 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:04:57.167052984 CET | 49705 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:07.403001070 CET | 49714 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:08.417166948 CET | 49714 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:10.417057037 CET | 49714 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:14.417088985 CET | 49714 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:22.432729959 CET | 49714 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:31.824884892 CET | 49722 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:32.838964939 CET | 49722 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:34.854628086 CET | 49722 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:38.854720116 CET | 49722 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:46.870346069 CET | 49722 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:56.465588093 CET | 49730 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:57.479644060 CET | 49730 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:05:59.479628086 CET | 49730 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:06:03.495356083 CET | 49730 | 505 | 192.168.2.6 | 185.172.175.125 |
| Mar 24, 2025 22:06:11.495294094 CET | 49730 | 505 | 192.168.2.6 | 185.172.175.125 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 24, 2025 22:04:10.110701084 CET | 63748 | 53 | 192.168.2.6 | 1.1.1.1 |
| Mar 24, 2025 22:04:10.218833923 CET | 53 | 63748 | 1.1.1.1 | 192.168.2.6 |
| Mar 24, 2025 22:04:16.732835054 CET | 52481 | 53 | 192.168.2.6 | 1.1.1.1 |
| Mar 24, 2025 22:04:16.840832949 CET | 53 | 52481 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 24, 2025 22:04:10.110701084 CET | 192.168.2.6 | 1.1.1.1 | 0xc79a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 24, 2025 22:04:16.732835054 CET | 192.168.2.6 | 1.1.1.1 | 0x73a5 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 24, 2025 22:04:10.218833923 CET | 1.1.1.1 | 192.168.2.6 | 0xc79a | No error (0) | 185.199.111.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:04:10.218833923 CET | 1.1.1.1 | 192.168.2.6 | 0xc79a | No error (0) | 185.199.109.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:04:10.218833923 CET | 1.1.1.1 | 192.168.2.6 | 0xc79a | No error (0) | 185.199.110.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:04:10.218833923 CET | 1.1.1.1 | 192.168.2.6 | 0xc79a | No error (0) | 185.199.108.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:04:16.840832949 CET | 1.1.1.1 | 192.168.2.6 | 0x73a5 | No error (0) | 185.172.175.125 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49692 | 185.199.111.133 | 443 | 7744 | C:\Users\user\Desktop\XoilaFixer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-24 21:04:10 UTC | 101 | OUT | |
| 2025-03-24 21:04:10 UTC | 875 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN | |
| 2025-03-24 21:04:10 UTC | 1378 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 1 |
| Start time: | 17:04:08 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\Desktop\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x3e0000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 8 |
| Start time: | 17:04:20 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x450000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 17:04:28 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xd30000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
