Edit tour

Windows Analysis Report
GvJxEfWyS1.ps1

Overview

General Information

Sample name:	GvJxEfWyS1.ps1 renamed because original name is a hash value
Original sample name:	41f746cfbfc418caee659826b7fc4728e1347014ea5f0c840728b30ba31b3c8b.ps1
Analysis ID:	1517139
MD5:	7cee317b8911c2bf3f013b44caac9e4e
SHA1:	91dac8bcdc075a226d21292563c5db084b826f80
SHA256:	41f746cfbfc418caee659826b7fc4728e1347014ea5f0c840728b30ba31b3c8b
Tags:	ps1vecotr-viewdns-netuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6888 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 3300 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x17468:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x17505:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1761a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x172da:$cnc4: POST / HTTP/1.1
00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6aa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6b45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6c5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x691a:$cnc4: POST / HTTP/1.1
00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1a9678:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1a9715:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1a982a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1a94ea:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 6888	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 3300	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.powershell.exe.199c1fe99d0.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.199c1fe99d0.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4ea8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x4f45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x505a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4d1a:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.199c16b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.199c36cfbb0.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.199c36cfbb0.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b1a:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.199c16b0000.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.199c1fe99d0.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.199c1fe99d0.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b1a:$cnc4: POST / HTTP/1.1
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", ProcessId: 6888, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1", ProcessId: 6888, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:20:02.897899+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:03.055016+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:16.309537+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:29.508594+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:32.895440+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:42.746601+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:53.398958+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:57.461284+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.414794+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.509419+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.604156+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:01.086561+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:02.893343+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:14.468164+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:27.554989+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:30.321634+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:32.899726+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:43.570050+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:45.929708+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:46.027566+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:52.558234+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:56.120661+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:56.244818+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:02.339361+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:02.913986+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:04.628138+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:11.150265+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:18.940931+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:22.389123+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:26.448896+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:27.445851+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:32.289633+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:32.891114+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.164741+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.164776+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.165159+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:51.243424+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:57.612973+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:02.900551+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:09.258597+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.313701+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.409315+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.788726+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.789658+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.789921+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:19.176603+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:30.054998+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:32.912145+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:33.577159+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:41.626485+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:20:03.222875+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:16.311312+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:29.510762+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:42.748832+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:53.402168+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:57.466451+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.417090+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.511498+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.606163+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:01.088240+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:14.471577+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:27.556880+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:30.324508+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:43.572154+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:45.933945+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.029729+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.144476+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.352521+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:52.568975+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:56.122936+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:56.246761+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:02.350083+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:04.637850+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:11.152100+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:22.391080+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:26.451884+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:27.448028+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:32.291961+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:38.167244+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:38.172539+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:51.247747+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:57.618282+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:09.260961+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.316871+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.410697+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.617290+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.790363+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.795706+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:19.181221+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:30.059563+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:33.579356+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:41.630251+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:20:02.897899+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:32.895440+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:02.893343+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:32.899726+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:02.913986+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:32.891114+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:02.900551+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:32.912145+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.4	49730	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:21:52.383496+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	49730	191.96.207.180	50000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: GvJxEfWyS1.ps1

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: vecotr.viewdns.net
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: 50000
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: <123456789>
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: XWorm V5.6
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack	String decryptor: USB.exe

Source:	Binary string: NewPE2.pdb source: powershell.exe, 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pDbV source: powershell.exe, 00000000.00000002.1887858223.00007FFD9BA80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NewPE2.pdb(@ source: powershell.exe, 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 191.96.207.180:50000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 191.96.207.180:50000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49730 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 191.96.207.180:50000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: vecotr.viewdns.net

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 191.96.207.180:50000

Source: Joe Sandbox View

IP Address: 191.96.207.180 191.96.207.180

Source: Joe Sandbox View

ASN Name: ASN-XTUDIONETES ASN-XTUDIONETES

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: vecotr.viewdns.net

Source: powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1846514640.00000199C1C21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1846514640.00000199C1C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.powershell.exe.199c1fe99d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B8AA0B2	0_2_00007FFD9B8AA0B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0292B2B8	2_2_0292B2B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_029281D8	2_2_029281D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02925510	2_2_02925510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0292BFF8	2_2_0292BFF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02925DE0	2_2_02925DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_029251C8	2_2_029251C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02920BA0	2_2_02920BA0

Source: 0.2.powershell.exe.199c1fe99d0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winPS1@4/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\N5Yy5TM3WOXfdPYN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgrbygw2.0sw.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: GvJxEfWyS1.ps1

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: NewPE2.pdb source: powershell.exe, 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pDbV source: powershell.exe, 00000000.00000002.1887858223.00007FFD9BA80000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NewPE2.pdb(@ source: powershell.exe, 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: uDdV8u69VKLnNev38PJ(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{uDdV8u69VKLnNev38PJ(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: uDdV8u69VKLnNev38PJ(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{uDdV8u69VKLnNev38PJ(typeof(IntPtr).TypeHandle),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_02927DA0 push eax; iretd

2_2_02927DA1

Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'coIv6gaxrKyOU6UxhGB', 'YmKxVlaSSMxjg7yeSZr', 'BPTavEfPI8', 'pdaPcya8thctOw7jJPR', 'e52AmiaR6Zmb9lryLLG', 'VFhmi5apOUL45Layo85', 's7lkoDagZ7SB5rZQITN', 'q7yQT6aJ19wG5Ff3PrV', 'eUANGaaiQTIQvIro7Lh', 'yOG8BOaIDUqRkTkYGTt'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, geUwbRLwd0WNm7K3QP.cs	High entropy of concatenated method names: 'rkesS35Cky', 'auIkQH6o4NfXZEtqLWo', 'UtNfEh6dtiuHEv5GyR3', 'tobPIO6cNsowhYm6JYZ', 'z08y4G6OJTjebtPXsBe', 'xM0xGg6Dv9ifjCVCALk', 's2oSNh6kHwXWCjPNT1e', 'RHJgFS6jYOqPmd8yqch', 'HCgwjo6NdCdqwgS1jXN'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, Native.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'M2DDfJCjDKI6dkvGbUU', 'HytCt3CceuoYVLARgTH', 'asbBtkCOLuWCxWmxMrH', 'iPe0TGCNg1ulsrFuGHe', 'XE084OCYFp6QURxQXNM', 'xNDrW9CmxlBnIETjTvQ'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, Str.cs	High entropy of concatenated method names: 'ReverseString', 'BinaryToString', 'yRVbf4CTORcmD8WTJOo', 'CGyNH1CXiymcSWZhYiZ', 'fAYOIbCErgtjxemufl3', 'Y23WHXCwRSKNSXICkhU', 'IvO6ajC1bhZeT4AHTEO', 'vHGAm5CepTLTEblhDwj', 'Vx8Qx4CvcsaBOBt7IZf', 'n2p6k0CrwoLDc063WAb'
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, PE.cs	High entropy of concatenated method names: 'Execute', 'muFoq8CAseaYDIPspOv', 'KRwVQXCGtZfeLlAnof5', 'arNOAMCxGMOePGZ8BMp', 'nnjcWOCSyXwHiJoVevG', 'Tvu02TCfqoPNp1rrRW2', 'nFaWI9Cl6YnHEcOun9x', 'oUX4ckCK7QI2rXqWGRQ', 'GFGnodC8lHNWHj6unEy', 'wBS7MKCRFTgjZ1Q4fVT'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'coIv6gaxrKyOU6UxhGB', 'YmKxVlaSSMxjg7yeSZr', 'BPTavEfPI8', 'pdaPcya8thctOw7jJPR', 'e52AmiaR6Zmb9lryLLG', 'VFhmi5apOUL45Layo85', 's7lkoDagZ7SB5rZQITN', 'q7yQT6aJ19wG5Ff3PrV', 'eUANGaaiQTIQvIro7Lh', 'yOG8BOaIDUqRkTkYGTt'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, geUwbRLwd0WNm7K3QP.cs	High entropy of concatenated method names: 'rkesS35Cky', 'auIkQH6o4NfXZEtqLWo', 'UtNfEh6dtiuHEv5GyR3', 'tobPIO6cNsowhYm6JYZ', 'z08y4G6OJTjebtPXsBe', 'xM0xGg6Dv9ifjCVCALk', 's2oSNh6kHwXWCjPNT1e', 'RHJgFS6jYOqPmd8yqch', 'HCgwjo6NdCdqwgS1jXN'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, Native.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'M2DDfJCjDKI6dkvGbUU', 'HytCt3CceuoYVLARgTH', 'asbBtkCOLuWCxWmxMrH', 'iPe0TGCNg1ulsrFuGHe', 'XE084OCYFp6QURxQXNM', 'xNDrW9CmxlBnIETjTvQ'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, Str.cs	High entropy of concatenated method names: 'ReverseString', 'BinaryToString', 'yRVbf4CTORcmD8WTJOo', 'CGyNH1CXiymcSWZhYiZ', 'fAYOIbCErgtjxemufl3', 'Y23WHXCwRSKNSXICkhU', 'IvO6ajC1bhZeT4AHTEO', 'vHGAm5CepTLTEblhDwj', 'Vx8Qx4CvcsaBOBt7IZf', 'n2p6k0CrwoLDc063WAb'
Source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, PE.cs	High entropy of concatenated method names: 'Execute', 'muFoq8CAseaYDIPspOv', 'KRwVQXCGtZfeLlAnof5', 'arNOAMCxGMOePGZ8BMp', 'nnjcWOCSyXwHiJoVevG', 'Tvu02TCfqoPNp1rrRW2', 'nFaWI9Cl6YnHEcOun9x', 'oUX4ckCK7QI2rXqWGRQ', 'GFGnodC8lHNWHj6unEy', 'wBS7MKCRFTgjZ1Q4fVT'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4289	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4540	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5283	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4916

Thread sleep time: -10145709240540247s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4169693759.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf11d

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, Native.cs	Reference to suspicious API methods: hZtBkRIAsdEfXyYT8l.DKNdSqYsy(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), eNT4yUcAs2TV1EOUTN.DKNdSqYsy(typeof(CreateApi).TypeHandle, eNT4yUcAs2TV1EOUTN.NP4OpjU4s), hZtBkRIAsdEfXyYT8l.mQhtqTkRs)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, Native.cs	Reference to suspicious API methods: hZtBkRIAsdEfXyYT8l.DKNdSqYsy(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), eNT4yUcAs2TV1EOUTN.DKNdSqYsy(typeof(CreateApi).TypeHandle, eNT4yUcAs2TV1EOUTN.NP4OpjU4s), hZtBkRIAsdEfXyYT8l.mQhtqTkRs)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, PE.cs	Reference to suspicious API methods: Native.WriteProcessMemory(processInformation.ProcessHandle, num10 + num16, array3, array3.Length, ref bytesWritten)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, PE.cs	Reference to suspicious API methods: Native.ReadProcessMemory(processInformation.ProcessHandle, num5 + 8, ref buffer2, 4, ref bytesWritten)
Source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, PE.cs	Reference to suspicious API methods: x42mfHCtV6jaJIpPla7(Native.VirtualAllocEx, processInformation.ProcessHandle, num6, length, 12288, 64)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 96C008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4172249930.0000000003078000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000002.00000002.4172249930.0000000003078000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-^q
Source: RegSvcs.exe, 00000002.00000002.4172249930.0000000003078000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\^q@\^q'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: RegSvcs.exe, 00000002.00000002.4172249930.0000000003078000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q'PING!<Xwormmm>Program Manager<Xwormmm>0Te^qp
Source: RegSvcs.exe, 00000002.00000002.4172249930.0000000003078000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.powershell.exe.199c16b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c36cfbb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.199c1fe99d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3300, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.powershell.exe.199c16b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c36cfbb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c36cfbb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c16b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.199c1fe99d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.199c1fe99d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3300, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	212 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	111 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	212 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GvJxEfWyS1.ps1	24%	ReversingLabs	Script-PowerShell.Backdoor.Xworm

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
vecotr.viewdns.net	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vecotr.viewdns.net	191.96.207.180	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vecotr.viewdns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1846514640.00000199C1C21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1846514640.00000199C1C21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.1871977770.00000199D1D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
191.96.207.180	vecotr.viewdns.net	Chile		60458	ASN-XTUDIONETES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517139
Start date and time:	2024-09-24 19:18:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GvJxEfWyS1.ps1 renamed because original name is a hash value
Original Sample Name:	41f746cfbfc418caee659826b7fc4728e1347014ea5f0c840728b30ba31b3c8b.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@4/5@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 95% Number of executed functions: 18 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6888 because it is empty
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: GvJxEfWyS1.ps1

Simulations

Behavior and APIs

Time	Type	Description
13:19:33	API Interceptor	42x Sleep call for process: powershell.exe modified
13:19:48	API Interceptor	8736330x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
191.96.207.180	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	payload_1.vbs	Get hash	malicious	XWorm	Browse
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vecotr.viewdns.net	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-XTUDIONETES	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180
	file_5822aee2333945a68f99cf2cfdd0e024_2024-09-16_14_28_33_034000.zip	Get hash	malicious	Unknown	Browse	179.61.228.98
	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse	45.151.195.118
	arm7.elf	Get hash	malicious	Mirai	Browse	185.37.230.233
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	45.131.83.43
	emsO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	45.131.83.43

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aysyiml5.jvd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgrbygw2.0sw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7284070836475958
Encrypted:	false
SSDEEP:	48:vhi/tD2l5LPr3C4U28ujgukvhkvklCyw2mdfK3RlCBSogZol/K3RlDBSogZoh1:0Il533CxHudkvhkvCCtRK3RhHuK3RKHe
MD5:	2D15929AD0D83FA21C5351D7DF826E37
SHA1:	4E35BB1554877F265D587A20985EEB437E3B457B
SHA-256:	CDEF0B86567C53D7BDE89EFA92D532C68169CDF06500BC8872639ACAAEF6DE25
SHA-512:	894BE044DBC91E31BAF42C98F3E87AD413B1E1D623511EEBEA5B23E3D781817C1FE374DC3BF474F198AC6B58E99F6E367ACE0A452AFC3FC1E3C32538EF363CDB
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...-/.v...........z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v............^.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^8Yj............................%..A.p.p.D.a.t.a...B.V.1.....8Ym...Roaming.@......CW.^8Ym............................%..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^8Yp.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K8EWC842OA6SYY98URXL.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7284070836475958
Encrypted:	false
SSDEEP:	48:vhi/tD2l5LPr3C4U28ujgukvhkvklCyw2mdfK3RlCBSogZol/K3RlDBSogZoh1:0Il533CxHudkvhkvCCtRK3RhHuK3RKHe
MD5:	2D15929AD0D83FA21C5351D7DF826E37
SHA1:	4E35BB1554877F265D587A20985EEB437E3B457B
SHA-256:	CDEF0B86567C53D7BDE89EFA92D532C68169CDF06500BC8872639ACAAEF6DE25
SHA-512:	894BE044DBC91E31BAF42C98F3E87AD413B1E1D623511EEBEA5B23E3D781817C1FE374DC3BF474F198AC6B58E99F6E367ACE0A452AFC3FC1E3C32538EF363CDB
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v...........z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v............^.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^8Yj............................%..A.p.p.D.a.t.a...B.V.1.....8Ym...Roaming.@......CW.^8Ym............................%..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..............................W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^8Yp.....Q...........

Static File Info

General

File type:	ASCII text, with very long lines (65526), with CRLF line terminators
Entropy (8bit):	3.1248255692674873
TrID:
File name:	GvJxEfWyS1.ps1
File size:	329'783 bytes
MD5:	7cee317b8911c2bf3f013b44caac9e4e
SHA1:	91dac8bcdc075a226d21292563c5db084b826f80
SHA256:	41f746cfbfc418caee659826b7fc4728e1347014ea5f0c840728b30ba31b3c8b
SHA512:	42fe836bf246af4bcc2259dde43cfd29612cd6e320e87bd714c31d61faf8f9322effbe99bb76e55dd92044de6fab8d6a8cb3d5122277b4f981a8534bfe92a601
SSDEEP:	3072:wL3D5WXtWVH44LhC8z60U4h3mShvTUfWwLC5ImBK5W9Fp81fABAUvetcTnZm:Q5W0H44LhC85TUOwqYyfbg
TLSH:	F064CC898537FB85CC0228A61D2B39F078C86D5EA1F5C8F0AF379C1A25D50589FBDDA1
File Content Preview:	try..{....$cake = "4D_5A_90_00_03_00_00_00_04_00_00_00_FF_FF_00_00_B8_00_00_00_00_00_00_00_40_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_80_00_00_00_0E_1F_BA_0E_00_B4_09_CD_21_B8_01_4C_CD_21_54

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T19:20:02.878931+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:02.897899+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:02.897899+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:03.055016+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:03.222875+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:16.309537+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:16.311312+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:29.508594+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:29.510762+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:32.895440+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:32.895440+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:42.746601+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:42.748832+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:53.398958+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:53.402168+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:57.461284+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:57.466451+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.414794+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.417090+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.509419+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.511498+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:20:58.604156+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:20:58.606163+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:01.086561+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:01.088240+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:02.893343+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:02.893343+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:14.468164+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:14.471577+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:27.554989+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:27.556880+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:30.321634+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:30.324508+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:32.899726+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:32.899726+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:43.570050+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:43.572154+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:45.929708+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:45.933945+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.027566+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:46.029729+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.144476+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:46.352521+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:52.383496+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:52.558234+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:52.568975+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:56.120661+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:56.122936+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:21:56.244818+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:21:56.246761+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:02.339361+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:02.350083+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:02.913986+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:02.913986+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:04.628138+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:04.637850+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:11.150265+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:11.152100+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:18.940931+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:22.389123+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:22.391080+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:26.448896+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:26.451884+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:27.445851+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:27.448028+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:32.289633+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:32.291961+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:32.891114+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:32.891114+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.164741+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.164776+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.165159+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:38.167244+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:38.172539+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:51.243424+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:51.247747+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:22:57.612973+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:22:57.618282+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:02.900551+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:02.900551+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:09.258597+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:09.260961+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.313701+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.316871+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.409315+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.410697+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.617290+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.788726+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.789658+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.789921+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:14.790363+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:14.795706+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:19.176603+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:19.181221+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:30.054998+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:30.059563+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:32.912145+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:32.912145+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:33.577159+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:33.579356+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP
2024-09-24T19:23:41.626485+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.4	49730	TCP
2024-09-24T19:23:41.630251+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	191.96.207.180	50000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:19:49.309956074 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:19:49.315283060 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:19:49.315373898 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:19:49.482865095 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:19:49.692908049 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:19:49.724298954 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:19:49.724344969 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:02.878931046 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:02.884051085 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:02.897898912 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:02.942919970 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:03.055016041 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:03.099200964 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:03.222875118 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:03.276057005 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:16.100122929 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:16.131674051 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:16.309536934 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:16.311311960 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:16.316488981 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:29.334016085 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:29.339200974 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:29.508594036 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:29.510761976 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:29.515670061 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:32.895440102 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:32.942889929 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:42.568135023 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:42.573328018 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:42.746601105 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:42.748831987 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:42.753742933 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:53.224598885 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:53.229576111 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:53.398957968 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:53.402168036 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:53.407021999 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:57.286943913 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:57.291922092 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:57.461283922 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:57.466450930 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:57.471323013 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.240181923 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.245101929 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.256033897 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.260936975 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.349453926 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.354365110 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.414793968 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.417089939 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.421889067 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.509418964 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.511497974 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.516587973 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.604156017 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:20:58.606163025 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:20:58.611073017 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:00.912002087 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:00.916929960 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:01.086560965 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:01.088239908 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:01.093074083 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:02.893342972 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:02.942910910 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:14.147440910 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:14.299743891 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:14.468163967 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:14.471576929 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:14.476506948 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:27.380673885 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:27.385847092 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:27.554989100 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:27.556879997 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:27.561739922 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:30.147229910 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:30.152126074 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:30.321634054 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:30.324507952 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:30.329840899 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:32.899725914 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:32.942955017 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:43.380654097 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:43.385766983 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:43.570050001 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:43.572154045 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:43.577188969 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.740076065 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:45.745217085 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.786948919 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:45.792435884 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.802571058 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:45.807555914 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.818465948 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:45.823391914 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.929708004 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:45.933944941 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:45.938884020 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:46.027565956 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:46.029728889 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:46.034563065 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:46.142451048 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:46.144475937 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:46.349517107 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:46.352520943 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:46.357454062 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:52.383496046 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:52.388720989 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:52.558233976 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:52.568974972 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:52.573951006 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:55.943350077 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:55.948422909 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:56.068275928 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:56.073533058 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:56.120661020 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:56.122936010 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:56.127779961 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:56.244817972 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:21:56.246761084 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:21:56.251919031 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:02.161876917 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:02.167937994 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:02.339360952 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:02.350083113 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:02.354861975 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:02.913985968 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:02.958513975 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:04.255922079 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:04.450105906 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:04.628138065 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:04.637850046 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:04.655674934 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:10.974451065 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:10.980886936 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:11.150264978 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:11.152100086 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:11.157147884 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:17.068283081 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:17.410545111 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:17.748002052 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:18.474489927 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:18.772656918 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:18.775325060 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:18.775414944 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:18.775439024 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:18.940931082 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:18.946384907 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:18.952760935 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:21.927484035 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:22.209439993 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:22.389122963 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:22.391079903 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:22.404474020 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:26.271640062 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:26.276828051 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:26.448895931 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:26.451884031 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:26.456758022 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:27.271425009 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:27.276555061 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:27.445851088 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:27.448028088 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:27.453020096 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:32.115010023 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:32.120223045 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:32.289633036 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:32.291960955 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:32.296928883 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:32.891113997 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:32.975533962 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:37.818177938 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:37.823314905 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:37.833822966 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:37.838766098 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:38.164741039 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:38.164776087 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:38.164850950 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:38.165158987 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:38.165294886 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:38.167243958 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:38.172488928 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:38.172538996 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:38.177439928 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:51.068162918 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:51.073148966 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:51.243423939 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:51.247746944 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:51.252722025 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:57.433222055 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:57.438250065 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:57.612972975 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:22:57.618282080 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:22:57.623172045 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:02.900551081 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:02.942893982 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:09.084018946 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:09.089071035 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:09.258596897 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:09.260961056 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:09.265798092 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.130762100 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.135828018 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.177700996 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.182641029 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.240242958 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.245287895 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.313700914 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.316870928 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.321913004 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.396297932 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.401276112 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.409315109 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.410696983 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.617290020 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.788666964 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.788726091 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.789658070 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.789921045 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.790133953 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.790363073 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.791762114 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.795208931 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:14.795706034 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:14.800626993 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:18.818134069 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:18.824938059 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:19.176603079 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:19.181221008 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:19.192198992 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:29.646691084 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:29.865014076 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:29.886060953 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:29.886081934 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:30.054997921 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:30.059562922 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:30.064393044 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:32.912144899 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:32.958498955 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:33.224380016 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:33.257854939 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:33.577158928 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:33.579355955 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:33.584253073 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:41.451445103 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:41.456404924 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:41.626485109 CEST	50000	49730	191.96.207.180	192.168.2.4
Sep 24, 2024 19:23:41.630250931 CEST	49730	50000	192.168.2.4	191.96.207.180
Sep 24, 2024 19:23:41.635236025 CEST	50000	49730	191.96.207.180	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:19:49.233422995 CEST	53211	53	192.168.2.4	1.1.1.1
Sep 24, 2024 19:19:49.252233028 CEST	53	53211	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 24, 2024 19:19:49.233422995 CEST	192.168.2.4	1.1.1.1	0xf03e	Standard query (0)	vecotr.viewdns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 24, 2024 19:19:49.252233028 CEST	1.1.1.1	192.168.2.4	0xf03e	No error (0)	vecotr.viewdns.net		191.96.207.180	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:19:31
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\GvJxEfWyS1.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1846514640.00000199C3A7D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1846349807.00000199C16B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1846514640.00000199C3645000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1846514640.00000199C1E47000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:19:31
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:19:45
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x6a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000002.4168640908.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.4172249930.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD9B8A41FA Relevance: 1.8, Strings: 1, Instructions: 558COMMON

Download Yara Rule

Strings

9N_H, xrefs: 00007FFD9B8A45A4

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: 9N_H
API String ID: 0-2470920388
Opcode ID: e4a936782f04fb1fd2dfc5a4e52e86f935c5062ec3fcb4cd04346da7fad7f9f8
Instruction ID: 8e2672485ca23d20999d78a2c716728e85d9b17d18629998abb61a3d653d40bc
Opcode Fuzzy Hash: e4a936782f04fb1fd2dfc5a4e52e86f935c5062ec3fcb4cd04346da7fad7f9f8
Instruction Fuzzy Hash: 02F15A3171EA8E4FEB59EB1CC4A59B577E0FF99350B0901BED08AC71A3DA25E842C750

Function 00007FFD9B971715 Relevance: 1.0, Instructions: 997COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fa8786ebecdb714dd341d03458312d1fdbe48aabc5d6f3f11b4f0d945c8290
Instruction ID: 0b523f2cf23501e831b34ac180aa6618fb50524e6286bcd013669914a957ea36
Opcode Fuzzy Hash: 80fa8786ebecdb714dd341d03458312d1fdbe48aabc5d6f3f11b4f0d945c8290
Instruction Fuzzy Hash: 68526932B1EB9D1FE76ACB6848A56B43BE1EF56214B0A01FBD44DC71E3DA18AD05C341

Function 00007FFD9B97251D Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a44615f73f0383ed5971e1fc49ebb273571a943d0516cbe40770b946351a7b8
Instruction ID: c1e9c73ca6c936bd6a929b147f4d4cb1826b07f18cdaed988e28c84eece05071
Opcode Fuzzy Hash: 6a44615f73f0383ed5971e1fc49ebb273571a943d0516cbe40770b946351a7b8
Instruction Fuzzy Hash: 9CE13B31A2F7891FE76A9BA858A65B53BD1EF57210B0901FFD089C71F3D918AD06C341

Function 00007FFD9B971215 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4720ed0e4bc824101c329d19f80dc209b02b4e5fd2d882914b1ebcddc066c727
Instruction ID: 482c4e4437c1bbfc7be97118dcb2b4da84e77628bb6305a8ee630607aa702d73
Opcode Fuzzy Hash: 4720ed0e4bc824101c329d19f80dc209b02b4e5fd2d882914b1ebcddc066c727
Instruction Fuzzy Hash: 64F18C71A0E7C95FE766DB6888A55643FE1EF16314F1900FED089CB1E3DA29AC46C341

Function 00007FFD9B971286 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a6eed9d91a4f12977d0ea33e8431a3874fdfe66e160f822316ca095c5e9584
Instruction ID: 236e2d74e227b24bbe26c905c98c4fd6f8a1dfd3fc91465338d4847876260064
Opcode Fuzzy Hash: e8a6eed9d91a4f12977d0ea33e8431a3874fdfe66e160f822316ca095c5e9584
Instruction Fuzzy Hash: 5DE15B71A0EBC95FE766DB6848A56643FE1EF16314B1900FED089CB1E3DA29AC46C341

Function 00007FFD9B97269E Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11445887ad55de23baf64271e40ae03c92779e8be5312f062c8bf9dfe0f6f045
Instruction ID: 0cecbad80592713c26cd935a1215f655865bdd0f40ad9f99f4efb35012d8c259
Opcode Fuzzy Hash: 11445887ad55de23baf64271e40ae03c92779e8be5312f062c8bf9dfe0f6f045
Instruction Fuzzy Hash: A511D372B2FA494FEBACDA9C54A217973D2EF99221B4500BFD04FC31B3DE19A8064704

Function 00007FFD9B971966 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885909991.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a02ee5720e21c570a5b4fad73970e92a1b715dee47d2bcfc99ede081edc195
Instruction ID: 794f5fbd8f22f3014a64bd409584e18cc8078ffc6dee776d8bcc1446f5292f34
Opcode Fuzzy Hash: d0a02ee5720e21c570a5b4fad73970e92a1b715dee47d2bcfc99ede081edc195
Instruction Fuzzy Hash: 24110B22F1EA6E1FF7BC969C346127413C1DF84624B4901BAD54DC32D7DD089D030245

Function 00007FFD9B8AC0F5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6459418d17c968f611493b202bc8878d7d6bbd4ef232a24e319b5c38e81a30cb
Instruction ID: 7e107eb4747ff55afe8b51e0595f4a933c7b56eb1c490ad315b6e32bfe9d6d84
Opcode Fuzzy Hash: 6459418d17c968f611493b202bc8878d7d6bbd4ef232a24e319b5c38e81a30cb
Instruction Fuzzy Hash: AF014C3090964C8FCF95EF58C859AE97FE0FF28305F0541AAE409C72A1DB34E680CB81

Function 00007FFD9B8A39B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: a60c8217fc3ab1d1633fbbe85b8e4839f1823a324ba25755aa0a64c516eb0ee6
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 5F01677121CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC36A5D636E882CB45

Function 00007FFD9B8AC165 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd924b9a3ca7912b261ee72bea4e94f17ad23c2fe4ce062260be5b8c14d0191
Instruction ID: ba282f4893627dd20662be7136d817878953ee02a01d1de680fd9ee5831c776d
Opcode Fuzzy Hash: 9cd924b9a3ca7912b261ee72bea4e94f17ad23c2fe4ce062260be5b8c14d0191
Instruction Fuzzy Hash: 1D0192B150A6859FDB07CF25CCD56883FB0EF2220CB0E56D2C458CE167EB24A56E8B51

Function 00007FFD9B8AC110 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fef5d6777b6df863bbcafe96c91916fd7bfdcdc3b77edbcc1359169ad11f76
Instruction ID: a7660c1925fdafa9e74a3cd1d414a857e9eb66d3814d055961100bbd4138fea9
Opcode Fuzzy Hash: 14fef5d6777b6df863bbcafe96c91916fd7bfdcdc3b77edbcc1359169ad11f76
Instruction Fuzzy Hash: 45F0EC30914A4D9FCF84EF58C859AEA7BF0FB68309F0041AAA40DD3260DB31E694CB81

Function 00007FFD9B8AC1A8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2d5ca3e0e76a51c1f117e9af46255b2b2b7f519923a6a5b7a43f74b7eb44f9
Instruction ID: 58a8cc6023f3c3294e3eb64d9d38af1b118e31116b5d7842f2058b5dfd7c950f
Opcode Fuzzy Hash: 3d2d5ca3e0e76a51c1f117e9af46255b2b2b7f519923a6a5b7a43f74b7eb44f9
Instruction Fuzzy Hash: FBE06877A0814A9BC306EB8CFC591E83B90EF01228F0801B2E00D8A073FA15650581C0

Function 00007FFD9B8AC935 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6e7ca561a79839724b1d66a27e7ed4e1215b1b96ddde801482fcf0f466d929
Instruction ID: 273c8d93fab55916fe1a40909c09d20bfb58c008cfbb79ae0c9d31cbfc7c5b2f
Opcode Fuzzy Hash: fd6e7ca561a79839724b1d66a27e7ed4e1215b1b96ddde801482fcf0f466d929
Instruction Fuzzy Hash: 0ED0A7D170F5CA1FE7565BB008B6165BB95AF59210B0C00FC908D8B1E7D91C1D058B51

Non-executed Functions

Function 00007FFD9B8AA0B2 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885415239.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cdd45b68ccd2aea852813b949d8a1a4a6d60b82954e3b4525b2e34f88fced7
Instruction ID: 11f692cd63a0baa7e17f8d02f975c15b15551b12e6ae79514a43998c240a84a1
Opcode Fuzzy Hash: b7cdd45b68ccd2aea852813b949d8a1a4a6d60b82954e3b4525b2e34f88fced7
Instruction Fuzzy Hash: 1332C374E0951D8FDB68DF98C8A5AACB7B1FF58304F1081ADD01EE7295CA34AA81CF54

Analysis Process: RegSvcs.exePID: 3300, Parent PID: 6888COMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	65
Total number of Limit Nodes:	5

Executed Functions

Function 029277F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,02927E3A), ref: 02927F27

Strings

sD, xrefs: 02927EDF

Memory Dump Source

Source File: 00000002.00000002.4171754036.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2920000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: sD
API String ID: 1890195054-1361941829
Opcode ID: 6e6c1af83b089c5d209241f93daec83f3fac9c32fbb015aedbf16e5e9d271123
Instruction ID: 0ffb6ed0c453b88ef7228e453243e7ac0d24d390e04946123dd429b6847cfeb6
Opcode Fuzzy Hash: 6e6c1af83b089c5d209241f93daec83f3fac9c32fbb015aedbf16e5e9d271123
Instruction Fuzzy Hash: 2A2167B1C046AADBCB10CFAAD444BDEFBF4AF08320F10816AD454B7254C338A944CFA5

Function 02927784 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,02927E3A), ref: 02927F27

Strings

sD, xrefs: 02927EDF

Memory Dump Source

Source File: 00000002.00000002.4171754036.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2920000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: sD
API String ID: 1890195054-1361941829
Opcode ID: a3b5e009b90fd19c22b08bec0c84807355a59f6803debac854a1fcea59266b8e
Instruction ID: 1627fe3ca41a15720e3d73739397383167e12d9748d4ac9f5a5fa073fc0a335a
Opcode Fuzzy Hash: a3b5e009b90fd19c22b08bec0c84807355a59f6803debac854a1fcea59266b8e
Instruction Fuzzy Hash: 811144B1C046699BCB10CF9AC444BDEFBF4EB08320F10816AE818B7240D378A944CFE5

Function 02927EBA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,02927E3A), ref: 02927F27

Strings

sD, xrefs: 02927EDF

Memory Dump Source

Source File: 00000002.00000002.4171754036.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2920000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: sD
API String ID: 1890195054-1361941829
Opcode ID: 6cb8b32b326f59a2d75850649c5e0a1e05b4fa53dcb5031e0052ede230b9843e
Instruction ID: e0a29641df8d69162c64ccc63822e4fd106c40c1681267bcdc403b35315b83fa
Opcode Fuzzy Hash: 6cb8b32b326f59a2d75850649c5e0a1e05b4fa53dcb5031e0052ede230b9843e
Instruction Fuzzy Hash: 481136B2C046699BCB10CF9AC444BDEFBF4BF08320F15816AD858B7240D378A944CFA5

Function 00BCD400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4169354330.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bcd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca78521eef8d771cf12c8c76902ee866990cd40a3e0c74c3d02edb11b8a4221
Instruction ID: db196df34a7927477c4596ecd1f29f0b64a4d31febd51f109bb4dde130de83b7
Opcode Fuzzy Hash: 8ca78521eef8d771cf12c8c76902ee866990cd40a3e0c74c3d02edb11b8a4221
Instruction Fuzzy Hash: 1421F179504204DFDB09DF14D9C0F27BFA5EB98324F20C2BDEA094A356C336E856C6A1

Function 00BCD3FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4169354330.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bcd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 94589f22acfec926a3c38d607a96620d9223c8c060b1e46bf8f893847a0a201f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: A611DF76504240DFDB16CF10D5C4B16BFA2FB94324F24C2ADD9090B256C33AE85ACBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GvJxEfWyS1.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aysyiml5.jvd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgrbygw2.0sw.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K8EWC842OA6SYY98URXL.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
GvJxEfWyS1.ps1

Function 029277F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMON

Function 02927784 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Function 02927EBA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON