Edit tour

Windows Analysis Report
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Overview

General Information

Sample name:	1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe
Analysis ID:	1652322
MD5:	919d580a19380debbf5159ec58c35562
SHA1:	6ec5d5f491148e4891666dedbce2f7f5976e59d6
SHA256:	877cbf41e73553688fed3a860de3bdaf5697a591ae9525469b00242137eaaa15
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe (PID: 6920 cmdline: "C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe" MD5: 919D580A19380DEBBF5159EC58C35562)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{
  "C2 url": [
    "jeggawire.ddns.net"
  ],
  "Port": 1111,
  "Aes key": "<123456789>",
  "SPL": "<Xwormmm>",
  "Install file": "USB.exe",
  "Version": "XWorm V5.0"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6377:$str01: $VB$Local_Port 0x6368:$str02: $VB$Local_Host 0x6662:$str03: get_Jpeg 0x6027:$str04: get_ServicePack 0x70ea:$str05: Select * from AntivirusProduct 0x72e8:$str06: PCRestart 0x72fc:$str07: shutdown.exe /f /r /t 0 0x73ae:$str08: StopReport 0x7384:$str09: StopDDos 0x747a:$str10: sendPlugin 0x7618:$str12: -ExecutionPolicy Bypass -File " 0x7741:$str13: Content-length: 5235
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x79ae:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7a4b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7b60:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x765c:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x77ae:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x784b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7960:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x745c:$cnc4: POST / HTTP/1.1
00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe PID: 6920	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x6377:$str01: $VB$Local_Port 0x6368:$str02: $VB$Local_Host 0x6662:$str03: get_Jpeg 0x6027:$str04: get_ServicePack 0x70ea:$str05: Select * from AntivirusProduct 0x72e8:$str06: PCRestart 0x72fc:$str07: shutdown.exe /f /r /t 0 0x73ae:$str08: StopReport 0x7384:$str09: StopDDos 0x747a:$str10: sendPlugin 0x7618:$str12: -ExecutionPolicy Bypass -File " 0x7741:$str13: Content-length: 5235
0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x79ae:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7a4b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7b60:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x765c:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-30T21:28:30.618078+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:37.026992+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:50.076928+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:57.616715+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:03.141015+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:16.201894+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:25.297158+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:27.616448+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:30.973164+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:31.199153+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:41.667276+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:44.238782+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:46.559500+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:46.791098+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:50.584427+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:52.485613+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:52.716309+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:56.172156+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:02.900388+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:03.446405+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:07.468590+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:14.659168+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:15.717930+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:19.097059+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:19.336909+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:23.220897+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:27.607442+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:28.024230+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:29.747415+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:39.983246+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:42.541377+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:42.772653+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:45.185681+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:45.672018+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:49.039359+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:50.222627+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:50.449491+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:53.515036+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:54.642100+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:55.975443+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:56.202106+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:56.661536+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:57.481385+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:57.713540+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:59.642080+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:01.764395+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:01.994939+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:12.294902+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:12.914985+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:13.543507+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:22.333521+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:22.563340+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:26.705027+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:27.613966+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:38.775615+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:42.651107+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:44.847444+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:47.839116+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:48.077092+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:48.304570+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:50.543294+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:52.612713+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:53.127478+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:54.308826+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:54.532671+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:57.611278+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:59.705194+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:32:05.022729+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:32:05.249310+0200	2852870	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-30T21:28:37.037271+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:28:50.079672+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:03.143741+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:16.206043+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:25.305031+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:31.199420+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:31.426712+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:41.671826+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:44.240550+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:46.791192+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:47.083092+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:50.586100+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:52.716415+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:52.993486+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:56.179138+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:56.641580+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:57.915595+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:03.446534+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:03.668617+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:07.471577+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:14.661452+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:15.720319+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:19.337148+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:19.559107+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:23.222640+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:27.947299+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:29.749554+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:39.986702+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:42.775637+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:43.058511+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:45.187364+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:45.674464+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:49.045533+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:50.449918+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:50.679773+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:53.517397+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:54.643756+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:56.202178+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:56.941051+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:57.483321+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:59.643915+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:01.995006+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:02.396424+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:12.418241+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:12.919282+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:13.545173+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:13.920319+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:22.563528+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:22.794099+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:26.708183+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:38.779465+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:42.712842+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:44.848978+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:48.304666+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:48.537951+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:50.547459+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:52.620940+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:53.133513+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:54.761513+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:59.708964+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:05.782262+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:19.664125+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:19.947511+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:20.313328+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-30T21:28:30.618078+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:57.616715+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:27.616448+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:27.607442+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:57.713540+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:27.613966+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:57.611278+0200	2852874	1	Malware Command and Control Activity Detected	176.65.134.56	1111	192.168.2.8	49682	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-30T21:30:02.673286+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.8	49682	176.65.134.56	1111	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["jeggawire.ddns.net"], "Port": 1111, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.0"}

Multi AV Scanner detection for submitted file

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Virustotal: Detection: 75%			Perma Link
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 95.7%

Sample uses string decryption to hide its real strings

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: jeggawire.ddns.net
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: 1111
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: <123456789>
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: XWorm V5.0
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	String decryptor: USB.exe

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 176.65.134.56:1111 -> 192.168.2.8:49682
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 176.65.134.56:1111 -> 192.168.2.8:49682
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49682 -> 176.65.134.56:1111
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49682 -> 176.65.134.56:1111
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49682 -> 176.65.134.56:1111

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: jeggawire.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: jeggawire.ddns.net

Source: global traffic

TCP traffic: 192.168.2.8:49682 -> 176.65.134.56:1111

Source: Joe Sandbox View

ASN Name: DIOGELO-ASGB DIOGELO-ASGB

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: jeggawire.ddns.net

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Code function: 0_2_00007FF936866876	0_2_00007FF936866876
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Code function: 0_2_00007FF936867622	0_2_00007FF936867622
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Code function: 0_2_00007FF936862A28	0_2_00007FF936862A28
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Code function: 0_2_00007FF93686B054	0_2_00007FF93686B054

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000000.840323147.00000000005DC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejegganewfile.exe4 vs 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Binary or memory string: OriginalFilenamejegganewfile.exe4 vs 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\FNajPvJhcrtOPazO

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Virustotal: Detection: 75%
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Code function: 0_2_00007FF936861789 push ebx; retf

0_2_00007FF93686178A

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Memory allocated: D00000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Window / User API: threadDelayed 4894			Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	Window / User API: threadDelayed 4938			Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe TID: 6476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe TID: 6380	Thread sleep count: 4894 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe TID: 6380	Thread sleep count: 4938 > 30	Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3290293188.000000001B860000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW %SystemRoot%\system32\mswsock.dll <add name="AspNetSqlRoleProvider" connectionStringName="LocalSqlServer" applicationName="/"

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.0000000002D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.0000000002D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.0000000002D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.0000000002D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.0000000002D74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Queries volume information: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3290293188.000000001B887000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe PID: 6920, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe PID: 6920, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	1 Input Capture	121 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

No bigger version

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	75%	Virustotal		Browse
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	86%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe	100%	Avira	TR/Spy.Gen
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
jeggawire.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jeggawire.ddns.net	176.65.134.56	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
jeggawire.ddns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe, 00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.134.56	jeggawire.ddns.net	Germany		56325	DIOGELO-ASGB	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652322
Start date and time:	2025-03-30 21:27:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 23.204.23.20, 2.23.227.215, 20.190.190.132, 23.57.90.146
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
15:28:16	API Interceptor	12623857x Sleep call for process: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.65.134.56	1743362767b39ce9ae90af463b2090fcece5c4349a42c3942cf272d75d62dd81aabd676faf123.dat-decoded.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jeggawire.ddns.net	1743362767b39ce9ae90af463b2090fcece5c4349a42c3942cf272d75d62dd81aabd676faf123.dat-decoded.exe	Get hash	malicious	XWorm	Browse	176.65.134.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIOGELO-ASGB	1743362767b39ce9ae90af463b2090fcece5c4349a42c3942cf272d75d62dd81aabd676faf123.dat-decoded.exe	Get hash	malicious	XWorm	Browse	176.65.134.56
	SZf8I0IvEg.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	176.65.134.105
	Z9dgTYzz4x.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.153
	killua.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.43
	a55fee51fe469b7ed4f23ef3753b380fb548d65f40306962.pptm.ps1	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.153
	sparc.nn.elf	Get hash	malicious	Mirai	Browse	176.65.134.15
	jae1h6e218.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.145
	5IY8PW2nOl.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.134.145
	tdm.js	Get hash	malicious	Remcos	Browse	176.65.134.41
	morte.x64.elf	Get hash	malicious	Unknown	Browse	176.65.134.62

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.6031175864082945
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe
File size:	36'864 bytes
MD5:	919d580a19380debbf5159ec58c35562
SHA1:	6ec5d5f491148e4891666dedbce2f7f5976e59d6
SHA256:	877cbf41e73553688fed3a860de3bdaf5697a591ae9525469b00242137eaaa15
SHA512:	40ab34dbf5816807aea748b8d621154cb318cb8314b5ce351561c85bebc5cdad6f5e40024aab7eec6fd0723bdb330dd60be1b1b24aacef3155c56c9666de0890
SSDEEP:	768:CqQq3QWIdhgbvnUASaKyobFf9kcrOMhe3XPc:CPq3QnbOvUgKyAFf9kcrOMsPc
TLSH:	3EF24D087B944226D9FD7FF169B371020674E613D913EB9D48E859EE2F277C08E013AA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q.g............................n.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40a56e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67E171D6 [Mon Mar 24 14:53:10 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa514	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8574	0x8600	8e6c775f7b6eeb8ea9afedc883ec5d48	False	0.5004081156716418	data	5.737529221071247	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4f0	0x600	c82c95498a964b689627edc80ea5e18f	False	0.3782552083333333	data	3.754317409647242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	baacbdcb4fc7d641e62fe9f1a5927e77	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x25c	data			0.4652317880794702
RT_MANIFEST	0xc300	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
FileDescription
FileVersion	1.0.0.0
InternalName	jegganewfile.exe
LegalCopyright
OriginalFilename	jegganewfile.exe
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-30T21:28:30.618078+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:30.618078+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:36.788927+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:28:37.026992+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:37.037271+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:28:50.076928+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:50.079672+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:28:57.616715+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:28:57.616715+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:03.141015+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:03.143741+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:16.201894+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:16.206043+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:25.297158+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:25.305031+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:27.616448+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:27.616448+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:30.973164+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:31.199153+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:31.199420+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:31.426712+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:41.667276+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:41.671826+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:44.238782+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:44.240550+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:46.559500+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:46.791098+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:46.791192+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:47.083092+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:50.584427+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:50.586100+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:52.485613+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:52.716309+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:52.716415+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:52.993486+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:56.172156+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:29:56.179138+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:56.641580+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:29:57.915595+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:02.673286+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:02.900388+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:03.446405+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:03.446534+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:03.668617+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:07.468590+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:07.471577+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:14.659168+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:14.661452+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:15.717930+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:15.720319+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:19.097059+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:19.336909+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:19.337148+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:19.559107+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:23.220897+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:23.222640+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:27.607442+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:27.607442+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:27.947299+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:28.024230+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:29.747415+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:29.749554+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:39.983246+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:39.986702+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:42.541377+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:42.772653+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:42.775637+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:43.058511+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:45.185681+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:45.187364+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:45.672018+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:45.674464+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:49.039359+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:49.045533+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:50.222627+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:50.449491+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:50.449918+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:50.679773+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:53.515036+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:53.517397+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:54.642100+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:54.643756+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:55.975443+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:56.202106+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:56.202178+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:56.661536+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:56.941051+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:57.481385+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:57.483321+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:30:57.713540+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:57.713540+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:59.642080+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:30:59.643915+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:01.764395+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:01.994939+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:01.995006+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:02.396424+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:12.294902+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:12.418241+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:12.914985+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:12.919282+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:13.543507+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:13.545173+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:13.920319+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:22.333521+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:22.563340+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:22.563528+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:22.794099+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:26.705027+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:26.708183+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:27.613966+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:27.613966+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:38.775615+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:38.779465+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:42.651107+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:42.712842+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:44.847444+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:44.848978+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:47.839116+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:48.077092+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:48.304570+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:48.304666+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:48.537951+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:50.543294+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:50.547459+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:52.612713+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:52.620940+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:53.127478+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:53.133513+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:54.308826+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:54.532671+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:54.761513+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:31:57.611278+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:57.611278+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:59.705194+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:31:59.708964+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:05.022729+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:32:05.249310+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	176.65.134.56	1111	192.168.2.8	49682	TCP
2025-03-30T21:32:05.782262+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:19.664125+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:19.947511+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP
2025-03-30T21:32:20.313328+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49682	176.65.134.56	1111	TCP

Network Port Distribution

Total Packets: 171
• 1111 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 30, 2025 21:28:19.349035978 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:20.344909906 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:22.360569954 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:22.577342033 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:22.577538013 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:23.724505901 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:24.008333921 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:30.618077993 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:30.673003912 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:36.788927078 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:37.026992083 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:37.037271023 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:37.319494009 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:49.845249891 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:50.076927900 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:50.079672098 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:28:50.366034031 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:57.616714954 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:28:57.657716036 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:02.909499884 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:03.141015053 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:03.143740892 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:03.425977945 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:15.970184088 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:16.201894045 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:16.206043005 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:16.491856098 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:25.063810110 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:25.297158003 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:25.305031061 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:25.584316969 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:27.616447926 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:27.657248020 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:30.751820087 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:30.973164082 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:30.973273993 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:31.199152946 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:31.199419975 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:31.426597118 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:31.426712036 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:31.702769995 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:31.703032970 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:31.975703955 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:41.438980103 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:41.667275906 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:41.671825886 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:41.954942942 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:43.673219919 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:44.043241978 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:44.238781929 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:44.240550041 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:44.275484085 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:44.526463032 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:46.329483032 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:46.559499979 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:46.559601068 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:46.791098118 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:46.791192055 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:47.083023071 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:47.083091974 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:47.363394976 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:50.345014095 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:50.584427118 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:50.586100101 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:50.866771936 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:52.251513958 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:52.485613108 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:52.485692978 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:52.716309071 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:52.716414928 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:52.993408918 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:52.993485928 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:53.279042959 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:55.626467943 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:56.127600908 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:56.172156096 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:56.179137945 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:56.359030962 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:56.641580105 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:56.869311094 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:57.610755920 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:57.883325100 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:57.911178112 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:29:57.915595055 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:29:58.214662075 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:02.673285961 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:02.900388002 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:02.900479078 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:03.438520908 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:03.446404934 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:03.446533918 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:03.668399096 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:03.668617010 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:03.677046061 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:03.945602894 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:07.235878944 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:07.468590021 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:07.471576929 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:07.762734890 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:14.438805103 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:14.659168005 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:14.661452055 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:14.945945024 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:15.487566948 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:15.717930079 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:15.720319033 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:15.988544941 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:18.860698938 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:19.097059011 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:19.097126007 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:19.336909056 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:19.337147951 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:19.558852911 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:19.559107065 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:19.835784912 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:19.836137056 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:20.113202095 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:22.688646078 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:23.094738007 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:23.220896959 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:23.222640038 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:23.505214930 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:27.567569971 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:27.607441902 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:27.798958063 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:27.923110962 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:27.929579020 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:27.947299004 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:28.024230003 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:28.024643898 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:28.220985889 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:29.516813993 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:29.747415066 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:29.749553919 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:30.023391962 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:39.752145052 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:39.983246088 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:39.986701965 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:40.251384020 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:42.313771963 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:42.541377068 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:42.543612003 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:42.772653103 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:42.775636911 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:43.054816008 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:43.058511019 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:43.334644079 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:44.954623938 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:45.185681105 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:45.187364101 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:45.449412107 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:45.449481964 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:45.672018051 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:45.674463987 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:45.967582941 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:48.814457893 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:49.039359093 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:49.045532942 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:49.326188087 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:49.985887051 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:50.222626925 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:50.222707987 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:50.449491024 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:50.449918032 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:50.675904989 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:50.679773092 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:50.963677883 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:50.967608929 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:51.237004042 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:53.282763004 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:53.515036106 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:53.517396927 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:53.782103062 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:54.407519102 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:54.642100096 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:54.643755913 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:54.926417112 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:55.751414061 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:55.975442886 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:55.975522995 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:56.202105999 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:56.202178001 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:56.427172899 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:56.429672956 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:56.661535978 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:56.661647081 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:56.940965891 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:56.941051006 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:57.223223925 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:57.251195908 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:57.481384993 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:57.483320951 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:57.713540077 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:57.789217949 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:59.407562017 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:59.642080069 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:30:59.643914938 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:30:59.924500942 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:01.532629967 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:01.764394999 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:01.764463902 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:01.994939089 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:01.995006084 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:02.266750097 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:02.396424055 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:02.675417900 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:11.751311064 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.188378096 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.294902086 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.295134068 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.412816048 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.418241024 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.533704996 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.533730030 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.594623089 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.688932896 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.689074039 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:12.914984941 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:12.919281960 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:13.194183111 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:13.314376116 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:13.543507099 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:13.545172930 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:13.920319080 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:14.149677992 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:22.094944000 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:22.333520889 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:22.333600998 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:22.563339949 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:22.563528061 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:22.792840004 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:22.794099092 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:23.069484949 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:23.073906898 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:23.344957113 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:26.473571062 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:26.705027103 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:26.708183050 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:26.985624075 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:27.613965988 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:27.688376904 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:38.548007011 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:38.775614977 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:38.779464960 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:39.054932117 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.079350948 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:42.485810041 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:42.651107073 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.651283979 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:42.712709904 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.712841988 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:42.884974003 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.884998083 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.982754946 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:42.986531973 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:42.986650944 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:43.206759930 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:43.213648081 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:43.271666050 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:44.610538006 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:44.847444057 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:44.848978043 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:45.131478071 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:47.610552073 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:47.839116096 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:47.839200020 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:48.077091932 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:48.077181101 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:48.304569960 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:48.304666042 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:48.530850887 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:48.537950993 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:48.816857100 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:48.820985079 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:49.099770069 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:50.313796043 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:50.543293953 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:50.547458887 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:50.813910961 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:52.376288891 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:52.612713099 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:52.620939970 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:52.896893978 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:52.899554014 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:53.127477884 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:53.133512974 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:53.410343885 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:54.079368114 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:54.308825970 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:54.308924913 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:54.532670975 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:54.535605907 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:54.761313915 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:54.761512995 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:55.110364914 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:55.355479956 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:55.359498024 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:55.590162992 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:55.590261936 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:55.958446026 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:56.191418886 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:57.611278057 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:57.693639040 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:59.470916033 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:59.705193996 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:31:59.708964109 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:31:59.988610983 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:04.798108101 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:05.022728920 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:05.022841930 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:05.249310017 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:05.249392986 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:05.729531050 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:05.782087088 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:05.782262087 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:06.008691072 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:06.008802891 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:06.281393051 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:18.173437119 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:18.532042027 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:18.758284092 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:19.048079014 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:19.317950964 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:19.661331892 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:19.664124966 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:19.944808960 CEST	1111	49682	176.65.134.56	192.168.2.8
Mar 30, 2025 21:32:19.947510958 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:20.313328028 CEST	49682	1111	192.168.2.8	176.65.134.56
Mar 30, 2025 21:32:20.538043976 CEST	1111	49682	176.65.134.56	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 30, 2025 21:28:19.100069046 CEST	56201	53	192.168.2.8	1.1.1.1
Mar 30, 2025 21:28:19.208246946 CEST	53	56201	1.1.1.1	192.168.2.8
Mar 30, 2025 21:29:01.937881947 CEST	53	62940	162.159.36.2	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 30, 2025 21:28:19.100069046 CEST	192.168.2.8	1.1.1.1	0x3daf	Standard query (0)	jeggawire.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 30, 2025 21:28:19.208246946 CEST	1.1.1.1	192.168.2.8	0x3daf	No error (0)	jeggawire.ddns.net		176.65.134.56	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Click to jump to process

Memory Usage

• 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

System Behavior

Analysis Process: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exePID: 6920, Parent PID: 4056

Function Logs

General

Target ID:	0
Start time:	15:28:12
Start date:	30/03/2025
Path:	C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe"
Imagebase:	0x5d0000
File size:	36'864 bytes
MD5 hash:	919D580A19380DEBBF5159EC58C35562
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.840308538.00000000005D2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3288796136.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Analysis Process: 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exePID: 6920, Parent PID: 4056COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	18.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 00007FF936862A28 Relevance: 2.2, Strings: 1, Instructions: 970
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_u6, xrefs: 00007FF93686A265

Memory Dump Source

Source File: 00000000.00000002.3290888851.00007FF936860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF936860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff936860000_1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae.jbxd

Similarity

API ID:
String ID: _u6
API String ID: 0-2070151557
Opcode ID: 2ad99b942af34641e089eb71ade4aab836a60b64bb1aab79969f04222708bb9f
Instruction ID: 9c1f05c7ff3fbeefb5957c0b82953c168f82f6871756ab09dccd878396c85288
Opcode Fuzzy Hash: 2ad99b942af34641e089eb71ade4aab836a60b64bb1aab79969f04222708bb9f
Instruction Fuzzy Hash: E2627130B1C90A4FFB68F7288495BBA76DAFF98310F554578D11ED32C2DEA8B8429741

Function 00007FF936866876 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3290888851.00007FF936860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF936860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff936860000_1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aff440e4e41b30c2698bc5082635a59d7bb3aadfb0acce73a3772ec808a8e54
Instruction ID: 5db0eb9401d8f0608d237b098f865fd1e7a24577b229b282683e0d9ddf281f7f
Opcode Fuzzy Hash: 5aff440e4e41b30c2698bc5082635a59d7bb3aadfb0acce73a3772ec808a8e54
Instruction Fuzzy Hash: 49F1A930508A8D8FEBA8DF28D855BE97BD1FF58310F04426EE85DC7291CF74A9958782

Function 00007FF936867622 Relevance: .5, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3290888851.00007FF936860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF936860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff936860000_1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22716ff3f299b4dfc7ce4d70a1d65c58cdf7ed714da6e5106d2132074f3f3bb
Instruction ID: 57e6d80cb8a156316afd8868d4286419b852f7f6a88ea732b4e66651db37329b
Opcode Fuzzy Hash: c22716ff3f299b4dfc7ce4d70a1d65c58cdf7ed714da6e5106d2132074f3f3bb
Instruction Fuzzy Hash: 97E1B430908A4D8FEBA8DF28C859BE97BE1EF58310F14426ED85DC7291DF78A94587C1

Function 00007FF936862128 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF9368621F1

Memory Dump Source

Source File: 00000000.00000002.3290888851.00007FF936860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF936860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff936860000_1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 4b12f980fb1e832b260077bfee80c993d8a2e25bfcb38972287cfc63e8628fac
Instruction ID: c37cfee7ea9e0aaff3f50366749e01e3ae9d9225161da2db94276aaf10d0ab7b
Opcode Fuzzy Hash: 4b12f980fb1e832b260077bfee80c993d8a2e25bfcb38972287cfc63e8628fac
Instruction Fuzzy Hash: E7410730A1CA494FEB18DB5C98467F9BBE5EB59321F00427ED00DC3292CAB5B812C781

Non-executed Functions

Function 00007FF93686B054 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3290888851.00007FF936860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF936860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff936860000_1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b95bdb234afc048e904526ec3877c189fa09fe92dd90a00f1c454ca5f3ed638
Instruction ID: 6397c36c8e9e2cbf34b74b06c351b93679ecbaf509d419aeab6ad680a17cc7f6
Opcode Fuzzy Hash: 0b95bdb234afc048e904526ec3877c189fa09fe92dd90a00f1c454ca5f3ed638
Instruction Fuzzy Hash: 7A71D52054E3C45FE347D338A858BA53FA5AF87229F0981FAE098CE4A3DAD95456D343

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
1743362826ccceca1466d46143044cb8d624b4839206fb65ac2eea5a81b59a8e2977ae7bc5620.dat-decoded.exe