Edit tour
Windows
Analysis Report
XoilaFixer.exe
Overview
General Information
| Sample name: | XoilaFixer.exe |
| Analysis ID: | 1647480 |
| MD5: | cd3c6e9d220bc5f45ccdbc65958b4595 |
| SHA1: | 4b1c43a79d6f0827f87a797734ee2ec9cc361e17 |
| SHA256: | 42e006cd726aa80af62ca03f177476b7c592bce5a77a4b3a074abda88e3dbe5d |
| Tags: | exeuser-BastianHein |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 88 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains potential unpacker
Joe Sandbox ML detected suspicious sample
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Drops PE files
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
XoilaFixer.exe (PID: 2520 cmdline: "C:\Users\ user\Deskt op\XoilaFi xer.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- XoilaFixer.exe (PID: 7116 cmdline:
"C:\Users\ user\AppDa ta\Roaming \XoilaFixe r.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- XoilaFixer.exe (PID: 3200 cmdline:
"C:\Users\ user\AppDa ta\Roaming \XoilaFixe r.exe" MD5: CD3C6E9D220BC5F45CCDBC65958B4595)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 6 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 10 entries | ||||
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
- • AV Detection
- • Compliance
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Boot Survival
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • Language, Device and Operating System Detection
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Code function: | 0_2_00007FF7C79C15AD | |
| Source: | Code function: | 0_2_00007FF7C79C15AD | |
| Source: | Code function: | 0_2_00007FF7C79C15AD | |
| Source: | Code function: | 0_2_00007FF7C79C15AD | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Security Software Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | Security Account Manager | 13 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Process Injection | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | 3 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Obfuscated Files or Information | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 56% | Virustotal | Browse | ||
| 100% | Avira | TR/Dropper.Gen |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/Dropper.Gen |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| abolhb.com | 185.172.175.125 | true | false | high | |
| raw.githubusercontent.com | 185.199.111.133 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 185.199.111.133 | raw.githubusercontent.com | Netherlands | 54113 | FASTLYUS | false | |
| 185.172.175.125 | abolhb.com | Lithuania | 25780 | HUGESERVER-NETWORKSUS | false |
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1647480 |
| Start date and time: | 2025-03-24 22:08:59 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 15s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | XoilaFixer.exe |
| Detection: | MAL |
| Classification: | mal88.troj.evad.winEXE@3/3@2/3 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, B ackgroundTransferHost.exe, WMI ADAP.exe, SIHClient.exe, backg roundTaskHost.exe, conhost.exe - Excluded IPs from analysis (wh
itelisted): 184.31.69.3, 172.2 02.163.200, 20.223.36.55, 150. 171.28.10, 23.33.40.136 - Excluded domains from analysis
(whitelisted): www.bing.com, fs.microsoft.com, slscr.update .microsoft.com, g.bing.com, pr od.fs.microsoft.com.akadns.net , fs-wildcard.microsoft.com.ed gekey.net, fs-wildcard.microso ft.com.edgekey.net.globalredir .akadns.net, e16604.dscf.akama iedge.net, arc.msn.com, fe3cr. delivery.mp.microsoft.com - Execution Graph export aborted
for target XoilaFixer.exe, PI D 2520 because it is empty - Execution Graph export aborted
for target XoilaFixer.exe, PI D 3200 because it is empty - Execution Graph export aborted
for target XoilaFixer.exe, PI D 7116 because it is empty - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtQueryValueKey calls found. - Report size getting too big, t
oo many NtReadVirtualMemory ca lls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 22:09:53 | Autostart | |
| 22:10:01 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 185.199.111.133 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 185.172.175.125 | Get hash | malicious | XWorm | Browse | ||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse | |||
| Get hash | malicious | Njrat, XWorm | Browse | |||
| Get hash | malicious | Njrat | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| raw.githubusercontent.com | Get hash | malicious | LummaC Stealer, Salat Stealer | Browse |
| |
| Get hash | malicious | Quasar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| abolhb.com | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse |
| ||
| Get hash | malicious | Njrat, XWorm | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| FASTLYUS | Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | HTMLPhisher, Invisible JS, Tycoon2FA | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| HUGESERVER-NETWORKSUS | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | LummaC Stealer, PureLog Stealer, XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, BitCoin Miner, XWorm, Xmrig | Browse |
| ||
| Get hash | malicious | Amadey, SystemBC | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Kdot Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | CAPTCHA Scam ClickFix | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
|
⊘No context
| Process: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 654 |
| Entropy (8bit): | 5.380476433908377 |
| Encrypted: | false |
| SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT |
| MD5: | 30E4BDFC34907D0E4D11152CAEBE27FA |
| SHA1: | 825402D6B151041BA01C5117387228EC9B7168BF |
| SHA-256: | A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63 |
| SHA-512: | 89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA |
| Malicious: | true |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 50176 |
| Entropy (8bit): | 5.579413998347093 |
| Encrypted: | false |
| SSDEEP: | 768:nwj1+sT2ijuJ4lJ87040qY1guzb+MMyklxfr1puhJOWF82o9Ze:nwjzT2iL/q8rb+MM/2bOH9k |
| MD5: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| SHA1: | 4B1C43A79D6F0827F87A797734EE2EC9CC361E17 |
| SHA-256: | 42E006CD726AA80AF62CA03F177476B7C592BCE5A77A4B3A074ABDA88E3DBE5D |
| SHA-512: | 00A6980EF286A075F18927364D200645695CA3B8AB3660B92135DE61BA688B1717B193A5EC2B79A0AFD9910DB42573A9C19520FD2D9DD5176F7A13E5135C2C31 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\XoilaFixer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.579413998347093 |
| TrID: |
|
| File name: | XoilaFixer.exe |
| File size: | 50'176 bytes |
| MD5: | cd3c6e9d220bc5f45ccdbc65958b4595 |
| SHA1: | 4b1c43a79d6f0827f87a797734ee2ec9cc361e17 |
| SHA256: | 42e006cd726aa80af62ca03f177476b7c592bce5a77a4b3a074abda88e3dbe5d |
| SHA512: | 00a6980ef286a075f18927364d200645695ca3b8ab3660b92135de61ba688b1717b193a5ec2b79a0afd9910db42573a9c19520fd2d9dd5176f7a13e5135c2c31 |
| SSDEEP: | 768:nwj1+sT2ijuJ4lJ87040qY1guzb+MMyklxfr1puhJOWF82o9Ze:nwjzT2iL/q8rb+MM/2bOH9k |
| TLSH: | AD33D7C9A3D50132C1FF5AB219F3520A92F4A593481AC75EBCD515DA3BA7BC88640FE3 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ........@.. ....................... ............@................................ |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x40d89e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x67E18AE7 [Mon Mar 24 16:40:07 2025 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xd850 | 0x4b | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xe000 | 0x5ca | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x10000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0xb8a4 | 0xba00 | fa2cf7d3d27950b16db0ceceb9d26120 | False | 0.435525873655914 | data | 5.663366865089623 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xe000 | 0x5ca | 0x600 | 3e2607ab137e445929296ac559c79835 | False | 0.4192708333333333 | data | 4.145944420748221 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x10000 | 0xc | 0x200 | 17acbfaf4a563f1c238819a61b0d67b2 | False | 0.044921875 | data | 0.08153941234324169 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0xe0a0 | 0x340 | data | 0.41466346153846156 | ||
| RT_MANIFEST | 0xe3e0 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5469387755102041 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
| Description | Data |
|---|---|
| Translation | 0x0000 0x04b0 |
| Comments | %Des% |
| CompanyName | %Company% |
| FileDescription | %Title% |
| FileVersion | 1.0.0.0 |
| InternalName | XoilaFixer.exe |
| LegalCopyright | %Copyright% |
| LegalTrademarks | %Trademark% |
| OriginalFilename | XoilaFixer.exe |
| ProductName | %Product% |
| ProductVersion | 1.0.0.0 |
| Assembly Version | 1.0.0.0 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
- Total Packets: 61
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 24, 2025 22:09:51.131509066 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.131557941 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.131788015 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.152631998 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.152647972 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.347076893 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.347158909 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.351155043 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.351165056 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.351385117 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.406193018 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.407901049 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.452331066 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.581324100 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.581491947 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.581521034 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.581557989 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.581581116 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.581631899 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.583991051 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.587198019 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.587229013 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.587337971 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.587347984 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.587405920 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.590805054 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.593398094 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.593441010 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.593451977 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.595505953 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.595568895 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.595577002 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.598140001 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.598196030 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.598202944 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.603887081 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.603946924 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.604063988 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.604072094 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.604196072 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.607204914 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.610366106 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.610393047 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.610431910 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.610440969 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.610480070 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.613658905 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.613739014 CET | 443 | 49718 | 185.199.111.133 | 192.168.2.5 |
| Mar 24, 2025 22:09:51.614537001 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:51.627937078 CET | 49718 | 443 | 192.168.2.5 | 185.199.111.133 |
| Mar 24, 2025 22:09:57.556767941 CET | 49720 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:09:58.562405109 CET | 49720 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:00.562405109 CET | 49720 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:04.562602997 CET | 49720 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:12.640537977 CET | 49720 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:20.595168114 CET | 49732 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:21.609313965 CET | 49732 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:23.624963045 CET | 49732 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:27.640568972 CET | 49732 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:35.640645981 CET | 49732 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:42.720475912 CET | 49737 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:43.718750000 CET | 49737 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:45.718817949 CET | 49737 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:49.718780994 CET | 49737 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:10:57.718799114 CET | 49737 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:08.580179930 CET | 49744 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:09.593806982 CET | 49744 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:11.593802929 CET | 49744 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:15.593800068 CET | 49744 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:23.609456062 CET | 49744 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:32.363866091 CET | 49749 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:33.359687090 CET | 49749 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:35.375099897 CET | 49749 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:39.390970945 CET | 49749 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:47.390969992 CET | 49749 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:55.358314991 CET | 49755 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:56.359549999 CET | 49755 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:11:58.375246048 CET | 49755 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:02.375160933 CET | 49755 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:10.375235081 CET | 49755 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:20.019640923 CET | 49761 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:21.031524897 CET | 49761 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:23.047126055 CET | 49761 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:27.047152042 CET | 49761 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:35.047087908 CET | 49761 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:45.785589933 CET | 49767 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:46.797137022 CET | 49767 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:48.797208071 CET | 49767 | 505 | 192.168.2.5 | 185.172.175.125 |
| Mar 24, 2025 22:12:52.797161102 CET | 49767 | 505 | 192.168.2.5 | 185.172.175.125 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 24, 2025 22:09:51.021795034 CET | 58709 | 53 | 192.168.2.5 | 1.1.1.1 |
| Mar 24, 2025 22:09:51.123230934 CET | 53 | 58709 | 1.1.1.1 | 192.168.2.5 |
| Mar 24, 2025 22:09:57.441762924 CET | 62547 | 53 | 192.168.2.5 | 1.1.1.1 |
| Mar 24, 2025 22:09:57.555185080 CET | 53 | 62547 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 24, 2025 22:09:51.021795034 CET | 192.168.2.5 | 1.1.1.1 | 0x6362 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 24, 2025 22:09:57.441762924 CET | 192.168.2.5 | 1.1.1.1 | 0xb6e3 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 24, 2025 22:09:51.123230934 CET | 1.1.1.1 | 192.168.2.5 | 0x6362 | No error (0) | 185.199.111.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:09:51.123230934 CET | 1.1.1.1 | 192.168.2.5 | 0x6362 | No error (0) | 185.199.110.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:09:51.123230934 CET | 1.1.1.1 | 192.168.2.5 | 0x6362 | No error (0) | 185.199.108.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:09:51.123230934 CET | 1.1.1.1 | 192.168.2.5 | 0x6362 | No error (0) | 185.199.109.133 | A (IP address) | IN (0x0001) | false | ||
| Mar 24, 2025 22:09:57.555185080 CET | 1.1.1.1 | 192.168.2.5 | 0xb6e3 | No error (0) | 185.172.175.125 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49718 | 185.199.111.133 | 443 | 2520 | C:\Users\user\Desktop\XoilaFixer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-24 21:09:51 UTC | 101 | OUT | |
| 2025-03-24 21:09:51 UTC | 873 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN | |
| 2025-03-24 21:09:51 UTC | 1378 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 17:09:49 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\Desktop\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x5a0000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 17:10:01 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x510000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 17:10:09 |
| Start date: | 24/03/2025 |
| Path: | C:\Users\user\AppData\Roaming\XoilaFixer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x450000 |
| File size: | 50'176 bytes |
| MD5 hash: | CD3C6E9D220BC5F45CCDBC65958B4595 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
