Edit tour

Windows Analysis Report
84Z63SyEQ7.ps1

Overview

General Information

Sample name:	84Z63SyEQ7.ps1 renamed because original name is a hash value
Original sample name:	fc80cb0479aa75176137ece45d778fb4631b7aaaf294e9bd2640b56c686643bb.ps1
Analysis ID:	1517140
MD5:	1c46bfc607b523389fcc8bd1d3407f84
SHA1:	6f187008fffde9d48ba4c591e5965ea2906bed3d
SHA256:	fc80cb0479aa75176137ece45d778fb4631b7aaaf294e9bd2640b56c686643bb
Tags:	ps1vecotr-viewdns-netuser-JAMESWT_MHT
Infos:

Detection

PureLog Stealer, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 1340 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 6196 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 6544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6aa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6b45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6c5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x691a:$cnc4: POST / HTTP/1.1
00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1ae08:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1aea5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1afba:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1ac7a:$cnc4: POST / HTTP/1.1
00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1a8660:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1a86fd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1a8812:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1a84d2:$cnc4: POST / HTTP/1.1
00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1340	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 6544	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.powershell.exe.1a9805099b8.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1a9805099b8.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x4ea8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x4f45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x505a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x4d1a:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.1a981e19bf8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.1a981e19bf8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b1a:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.1a998460000.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.1a998460000.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.powershell.exe.1a9805099b8.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1a9805099b8.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b1a:$cnc4: POST / HTTP/1.1
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", ProcessId: 1340, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1", ProcessId: 1340, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:24:26.817842+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:32.899730+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:39.062028+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:51.653604+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:51.656316+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:02.894554+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:03.561380+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:15.811499+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:26.324631+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:32.877186+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:33.487018+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:37.545843+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:39.343159+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:42.671236+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.107228+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.218034+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.398167+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:58.718840+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:02.902771+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:08.671188+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:08.979804+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:09.105032+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:09.467868+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:15.278052+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:20.732013+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:22.657089+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:25.530128+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:29.985575+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:30.760723+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:30.860403+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.062648+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.140732+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.769681+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.870953+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.971000+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.080175+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.352873+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.479781+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:49.627657+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:01.875888+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:02.895217+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:09.230503+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:11.483815+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:13.795808+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:14.655732+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:15.184090+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:21.922348+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:23.585574+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:29.421109+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:32.888558+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:34.313786+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.390069+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.480306+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.576963+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.652221+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.747754+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.843024+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.936341+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:48.640042+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:49.846197+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:58.815359+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:01.301630+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:01.303044+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:02.917782+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:24:26.870741+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:24:39.073363+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:24:51.656861+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:03.563323+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:15.814071+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:26.332535+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:33.492913+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:37.577009+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:39.344834+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:42.673337+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.115374+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.219781+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.305750+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.400183+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:58.720912+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:08.674371+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:08.981775+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:09.107168+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:09.472324+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:15.280343+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:20.734284+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:22.658696+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:25.541196+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:29.991426+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:30.762241+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:30.861844+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:36.785373+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:36.872686+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:36.972442+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.081706+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.354521+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.481183+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:49.630042+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:01.877504+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:09.233437+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:11.485486+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:13.797724+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:14.657329+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:15.185755+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:21.924061+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:23.587318+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:29.423308+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:34.315423+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.393018+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.483419+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.581630+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.654039+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.749616+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.844645+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.938126+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:48.647336+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:49.848024+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:58.818389+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:28:01.302346+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:24:32.899730+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:02.894554+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:32.877186+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:02.902771+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.062648+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.140732+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:02.895217+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:32.888558+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:02.917782+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.6	49717	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:26:14.903524+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.6	49717	191.96.207.180	50000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: 84Z63SyEQ7.ps1

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: vecotr.viewdns.net
Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: 50000
Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: <123456789>
Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Xwormmm>
Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: XWorm V5.6
Source: 4.2.RegSvcs.exe.400000.0.unpack	String decryptor: USB.exe

Source:	Binary string: NewPE2.pdb source: powershell.exe, 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NewPE2.pdb(@ source: powershell.exe, 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49717 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 191.96.207.180:50000 -> 192.168.2.6:49717
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49717 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 191.96.207.180:50000 -> 192.168.2.6:49717
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49717 -> 191.96.207.180:50000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: vecotr.viewdns.net

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 191.96.207.180:50000

Source: Joe Sandbox View

IP Address: 191.96.207.180 191.96.207.180

Source: Joe Sandbox View

ASN Name: ASN-XTUDIONETES ASN-XTUDIONETES

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: vecotr.viewdns.net

Source: powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2280796718.000001A980141000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.2280796718.000001A980141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.powershell.exe.1a9805099b8.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD347740F2	0_2_00007FFD347740F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34773CFA	0_2_00007FFD34773CFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34773EF5	0_2_00007FFD34773EF5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD34773F53	0_2_00007FFD34773F53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026F6348	4_2_026F6348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026FB038	4_2_026FB038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026F5670	4_2_026F5670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026F84B8	4_2_026F84B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026F5328	4_2_026F5328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_026F0BA0	4_2_026F0BA0

Source: 0.2.powershell.exe.1a9805099b8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winPS1@6/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\FxwhhRft8tFCNpWd
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxxvivap.sdx.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 84Z63SyEQ7.ps1

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: NewPE2.pdb source: powershell.exe, 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NewPE2.pdb(@ source: powershell.exe, 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: uDdV8u69VKLnNev38PJ(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{uDdV8u69VKLnNev38PJ(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: uDdV8u69VKLnNev38PJ(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{uDdV8u69VKLnNev38PJ(typeof(IntPtr).TypeHandle),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'coIv6gaxrKyOU6UxhGB', 'YmKxVlaSSMxjg7yeSZr', 'BPTavEfPI8', 'pdaPcya8thctOw7jJPR', 'e52AmiaR6Zmb9lryLLG', 'VFhmi5apOUL45Layo85', 's7lkoDagZ7SB5rZQITN', 'q7yQT6aJ19wG5Ff3PrV', 'eUANGaaiQTIQvIro7Lh', 'yOG8BOaIDUqRkTkYGTt'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, geUwbRLwd0WNm7K3QP.cs	High entropy of concatenated method names: 'rkesS35Cky', 'auIkQH6o4NfXZEtqLWo', 'UtNfEh6dtiuHEv5GyR3', 'tobPIO6cNsowhYm6JYZ', 'z08y4G6OJTjebtPXsBe', 'xM0xGg6Dv9ifjCVCALk', 's2oSNh6kHwXWCjPNT1e', 'RHJgFS6jYOqPmd8yqch', 'HCgwjo6NdCdqwgS1jXN'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, Native.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'M2DDfJCjDKI6dkvGbUU', 'HytCt3CceuoYVLARgTH', 'asbBtkCOLuWCxWmxMrH', 'iPe0TGCNg1ulsrFuGHe', 'XE084OCYFp6QURxQXNM', 'xNDrW9CmxlBnIETjTvQ'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, Str.cs	High entropy of concatenated method names: 'ReverseString', 'BinaryToString', 'yRVbf4CTORcmD8WTJOo', 'CGyNH1CXiymcSWZhYiZ', 'fAYOIbCErgtjxemufl3', 'Y23WHXCwRSKNSXICkhU', 'IvO6ajC1bhZeT4AHTEO', 'vHGAm5CepTLTEblhDwj', 'Vx8Qx4CvcsaBOBt7IZf', 'n2p6k0CrwoLDc063WAb'
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, PE.cs	High entropy of concatenated method names: 'Execute', 'muFoq8CAseaYDIPspOv', 'KRwVQXCGtZfeLlAnof5', 'arNOAMCxGMOePGZ8BMp', 'nnjcWOCSyXwHiJoVevG', 'Tvu02TCfqoPNp1rrRW2', 'nFaWI9Cl6YnHEcOun9x', 'oUX4ckCK7QI2rXqWGRQ', 'GFGnodC8lHNWHj6unEy', 'wBS7MKCRFTgjZ1Q4fVT'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'coIv6gaxrKyOU6UxhGB', 'YmKxVlaSSMxjg7yeSZr', 'BPTavEfPI8', 'pdaPcya8thctOw7jJPR', 'e52AmiaR6Zmb9lryLLG', 'VFhmi5apOUL45Layo85', 's7lkoDagZ7SB5rZQITN', 'q7yQT6aJ19wG5Ff3PrV', 'eUANGaaiQTIQvIro7Lh', 'yOG8BOaIDUqRkTkYGTt'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, geUwbRLwd0WNm7K3QP.cs	High entropy of concatenated method names: 'rkesS35Cky', 'auIkQH6o4NfXZEtqLWo', 'UtNfEh6dtiuHEv5GyR3', 'tobPIO6cNsowhYm6JYZ', 'z08y4G6OJTjebtPXsBe', 'xM0xGg6Dv9ifjCVCALk', 's2oSNh6kHwXWCjPNT1e', 'RHJgFS6jYOqPmd8yqch', 'HCgwjo6NdCdqwgS1jXN'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, Native.cs	High entropy of concatenated method names: 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'M2DDfJCjDKI6dkvGbUU', 'HytCt3CceuoYVLARgTH', 'asbBtkCOLuWCxWmxMrH', 'iPe0TGCNg1ulsrFuGHe', 'XE084OCYFp6QURxQXNM', 'xNDrW9CmxlBnIETjTvQ'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, Str.cs	High entropy of concatenated method names: 'ReverseString', 'BinaryToString', 'yRVbf4CTORcmD8WTJOo', 'CGyNH1CXiymcSWZhYiZ', 'fAYOIbCErgtjxemufl3', 'Y23WHXCwRSKNSXICkhU', 'IvO6ajC1bhZeT4AHTEO', 'vHGAm5CepTLTEblhDwj', 'Vx8Qx4CvcsaBOBt7IZf', 'n2p6k0CrwoLDc063WAb'
Source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, PE.cs	High entropy of concatenated method names: 'Execute', 'muFoq8CAseaYDIPspOv', 'KRwVQXCGtZfeLlAnof5', 'arNOAMCxGMOePGZ8BMp', 'nnjcWOCSyXwHiJoVevG', 'Tvu02TCfqoPNp1rrRW2', 'nFaWI9Cl6YnHEcOun9x', 'oUX4ckCK7QI2rXqWGRQ', 'GFGnodC8lHNWHj6unEy', 'wBS7MKCRFTgjZ1Q4fVT'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4090	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5758	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1365	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8459	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5156

Thread sleep time: -14757395258967632s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.4595681946.0000000000C57000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, Native.cs	Reference to suspicious API methods: hZtBkRIAsdEfXyYT8l.DKNdSqYsy(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), eNT4yUcAs2TV1EOUTN.DKNdSqYsy(typeof(CreateApi).TypeHandle, eNT4yUcAs2TV1EOUTN.NP4OpjU4s), hZtBkRIAsdEfXyYT8l.mQhtqTkRs)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, Native.cs	Reference to suspicious API methods: hZtBkRIAsdEfXyYT8l.DKNdSqYsy(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), eNT4yUcAs2TV1EOUTN.DKNdSqYsy(typeof(CreateApi).TypeHandle, eNT4yUcAs2TV1EOUTN.NP4OpjU4s), hZtBkRIAsdEfXyYT8l.mQhtqTkRs)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, PE.cs	Reference to suspicious API methods: Native.WriteProcessMemory(processInformation.ProcessHandle, num10 + num16, array3, array3.Length, ref bytesWritten)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, PE.cs	Reference to suspicious API methods: Native.ReadProcessMemory(processInformation.ProcessHandle, num5 + 8, ref buffer2, 4, ref bytesWritten)
Source: 0.2.powershell.exe.1a998460000.2.raw.unpack, PE.cs	Reference to suspicious API methods: x42mfHCtV6jaJIpPla7(Native.VirtualAllocEx, processInformation.ProcessHandle, num6, length, 12288, 64)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 79C008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.4595681946.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a981e19bf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a998460000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a998460000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.1a9805099b8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6544, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.powershell.exe.1a981e19bf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a981e19bf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a998460000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a998460000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.1a9805099b8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1a9805099b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	121 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
84Z63SyEQ7.ps1	24%	ReversingLabs	Script-PowerShell.Backdoor.Xworm

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
vecotr.viewdns.net	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vecotr.viewdns.net	191.96.207.180	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vecotr.viewdns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2280796718.000001A980141000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2280796718.000001A980141000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.2301132284.000001A9902B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
191.96.207.180	vecotr.viewdns.net	Chile		60458	ASN-XTUDIONETES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517140
Start date and time:	2024-09-24 19:23:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	84Z63SyEQ7.ps1 renamed because original name is a hash value
Original Sample Name:	fc80cb0479aa75176137ece45d778fb4631b7aaaf294e9bd2640b56c686643bb.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@6/5@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 95% Number of executed functions: 12 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1340 because it is empty
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 84Z63SyEQ7.ps1

Simulations

Behavior and APIs

Time	Type	Description
13:23:53	API Interceptor	41x Sleep call for process: powershell.exe modified
13:24:13	API Interceptor	8606633x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
191.96.207.180	XClient.exe	Get hash	malicious	XWorm	Browse
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	payload_1.vbs	Get hash	malicious	XWorm	Browse
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vecotr.viewdns.net	XClient.exe	Get hash	malicious	XWorm	Browse	191.96.207.180
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-XTUDIONETES	XClient.exe	Get hash	malicious	XWorm	Browse	191.96.207.180
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180
	file_5822aee2333945a68f99cf2cfdd0e024_2024-09-16_14_28_33_034000.zip	Get hash	malicious	Unknown	Browse	179.61.228.98
	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse	45.151.195.118
	arm7.elf	Get hash	malicious	Mirai	Browse	185.37.230.233

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kd2fd5ey.qiu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxxvivap.sdx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7327858222885704
Encrypted:	false
SSDEEP:	48:rZDOlUtyZ3CyQU2UuIyukvhkvklCywdchltzlHJ8KSogZo98hltzlt8KSogZop1:tOZ3CKTBkvhkvCCtOhltzCHlhltzaHK
MD5:	D8A3F4E65D9F35604B26B57B7EB25709
SHA1:	B7757806C30E1A9C69CF1FCC3C08BF59BB6C2704
SHA-256:	875928EFADD5DD50B0ABEA929151D7DDFD9B9CFB9CE3DF1ED9752B93EFF99A17
SHA-512:	7595AEE3CF0A07411EF8D4065C503E3F86AEDFDCAE4B65E62DB06F8C3C9D4F9BCC38D5DF15C85349A7D087BA67E3A01AA3FE0D632BDC82DF15BF5654957E7B04
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.".. ...J.S....w#.....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...........c/.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<28Y.............................^.A.p.p.D.a.t.a...B.V.1.....8Y....Roaming.@......EW<28Y....../.....................F...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<28Y.....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<28Y.....2.....................6...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<28Y.....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<28Y.....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<28Y......u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UEK2DMRH2GD3AT5SXHI3.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7327858222885704
Encrypted:	false
SSDEEP:	48:rZDOlUtyZ3CyQU2UuIyukvhkvklCywdchltzlHJ8KSogZo98hltzlt8KSogZop1:tOZ3CKTBkvhkvCCtOhltzCHlhltzaHK
MD5:	D8A3F4E65D9F35604B26B57B7EB25709
SHA1:	B7757806C30E1A9C69CF1FCC3C08BF59BB6C2704
SHA-256:	875928EFADD5DD50B0ABEA929151D7DDFD9B9CFB9CE3DF1ED9752B93EFF99A17
SHA-512:	7595AEE3CF0A07411EF8D4065C503E3F86AEDFDCAE4B65E62DB06F8C3C9D4F9BCC38D5DF15C85349A7D087BA67E3A01AA3FE0D632BDC82DF15BF5654957E7B04
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S....w#.....z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S...........c/.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<28Y.............................^.A.p.p.D.a.t.a...B.V.1.....8Y....Roaming.@......EW<28Y....../.....................F...R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<28Y.....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<28Y.....2.....................6...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<28Y.....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<28Y.....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<28Y......u...........

Static File Info

General

File type:	ASCII text, with very long lines (65526), with CRLF line terminators
Entropy (8bit):	3.124818912023792
TrID:
File name:	84Z63SyEQ7.ps1
File size:	329'783 bytes
MD5:	1c46bfc607b523389fcc8bd1d3407f84
SHA1:	6f187008fffde9d48ba4c591e5965ea2906bed3d
SHA256:	fc80cb0479aa75176137ece45d778fb4631b7aaaf294e9bd2640b56c686643bb
SHA512:	dad58a75c8eef2cc756d202f8e90a4d6a58f173dd3838324be4ad14d8abb50e20f886b89e8dd3d2a9e406215896dd9650aa91e5d9da813319604e2034db23d31
SSDEEP:	3072:HL3D5WXtWVH44LhC8z60U4h3mSvsgTUfWwLC5ImBK5W9Fp81fABAUvetcTnZm:v5W0H44LhC87TUOwqYyfbg
TLSH:	C564CC898537FB85CC0228A61D2B39F078C86D5EA1F5C8F0AF379C1A25D50589FBDDA1
File Content Preview:	try..{....$cake = "4D_5A_90_00_03_00_00_00_04_00_00_00_FF_FF_00_00_B8_00_00_00_00_00_00_00_40_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_80_00_00_00_0E_1F_BA_0E_00_B4_09_CD_21_B8_01_4C_CD_21_54

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T19:24:26.644038+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:24:26.817842+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:26.870741+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:24:32.899730+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:32.899730+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:39.062028+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:39.073363+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:24:51.653604+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:51.656316+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:24:51.656861+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:02.894554+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:02.894554+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:03.561380+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:03.563323+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:15.811499+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:15.814071+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:26.324631+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:26.332535+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:32.877186+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:32.877186+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:33.487018+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:33.492913+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:37.545843+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:37.577009+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:39.343159+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:39.344834+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:42.671236+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:42.673337+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.107228+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.115374+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.218034+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.219781+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.305750+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:53.398167+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:53.400183+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:25:58.718840+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:25:58.720912+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:02.902771+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:02.902771+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:08.671188+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:08.674371+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:08.979804+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:08.981775+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:09.105032+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:09.107168+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:09.467868+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:09.472324+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:14.903524+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:15.278052+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:15.280343+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:20.732013+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:20.734284+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:22.657089+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:22.658696+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:25.530128+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:25.541196+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:29.985575+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:29.991426+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:30.760723+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:30.762241+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:30.860403+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:30.861844+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:33.062648+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.062648+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.140732+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:33.140732+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.769681+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.785373+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:36.870953+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.872686+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:36.971000+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:36.972442+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.080175+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.081706+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.352873+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.354521+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:37.479781+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:37.481183+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:26:49.627657+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:26:49.630042+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:01.875888+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:01.877504+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:02.895217+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:02.895217+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:09.230503+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:09.233437+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:11.483815+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:11.485486+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:13.795808+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:13.797724+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:14.655732+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:14.657329+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:15.184090+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:15.185755+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:21.922348+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:21.924061+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:23.585574+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:23.587318+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:29.421109+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:29.423308+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:32.888558+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:32.888558+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:34.313786+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:34.315423+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.390069+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.393018+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.480306+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.483419+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.576963+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.581630+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.652221+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.654039+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.747754+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.749616+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.843024+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.844645+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:44.936341+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:44.938126+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:48.640042+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:48.647336+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:49.846197+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:49.848024+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:27:58.815359+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:27:58.818389+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:28:01.301630+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:01.302346+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49717	191.96.207.180	50000	TCP
2024-09-24T19:28:01.303044+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:02.917782+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.6	49717	TCP
2024-09-24T19:28:02.917782+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.6	49717	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:24:14.197343111 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:14.202476025 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:14.202591896 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:14.391972065 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:14.564551115 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:26.644037962 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:26.648808956 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:26.817842007 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:26.870740891 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:26.875570059 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:32.899729967 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:32.950088024 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:38.888098001 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:38.893321991 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:39.062027931 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:39.073363066 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:39.078344107 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:51.137872934 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:51.143145084 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:51.653604031 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:51.656316042 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:24:51.656372070 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:51.656861067 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:24:51.677376986 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:02.894553900 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:02.950110912 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:03.387849092 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:03.392756939 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:03.561379910 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:03.563323021 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:03.568239927 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:15.637944937 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:15.642857075 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:15.811499119 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:15.814070940 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:15.820600033 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:26.012799978 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:26.156225920 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:26.324630976 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:26.332535028 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:26.337327003 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:32.877186060 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:32.918786049 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:33.313189983 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:33.318329096 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:33.487018108 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:33.492913008 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:33.497823954 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:37.372148991 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:37.377171993 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:37.545842886 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:37.577008963 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:37.581903934 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:39.169101954 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:39.173974991 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:39.343158960 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:39.344834089 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:39.349787951 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:42.497354031 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:42.502310991 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:42.671236038 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:42.673336983 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:42.678412914 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:52.887830973 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:52.938796043 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:52.938851118 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:52.943609953 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:52.950406075 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:52.957299948 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:52.965945959 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:52.971525908 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:52.981676102 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:52.986538887 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.107228041 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.115374088 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.120307922 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.169137955 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.174443007 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.218034029 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.219780922 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.224648952 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.303684950 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.305749893 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.311095953 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.311153889 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.316169977 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.398166895 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:53.400182962 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:53.405112028 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:58.544210911 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:58.550038099 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:58.718839884 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:25:58.720911980 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:25:58.726036072 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:02.902770996 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:02.950119019 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.497232914 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.502060890 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.671188116 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.674371004 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.679308891 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.778537035 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.783323050 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.793951988 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.798846006 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.979804039 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:08.981775045 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:08.987090111 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:09.105031967 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:09.107167959 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:09.112005949 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:09.294044971 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:09.298942089 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:09.467868090 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:09.472323895 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:09.477189064 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:14.903523922 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:15.111716032 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:15.278052092 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:15.280343056 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:15.285192966 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:20.169192076 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:20.481270075 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:20.564320087 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:20.564779043 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:20.732012987 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:20.734283924 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:20.739177942 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:22.481554031 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:22.486613989 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:22.657088995 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:22.658695936 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:22.663589001 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:25.356548071 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:25.361404896 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:25.530128002 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:25.541196108 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:25.545969963 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:29.811367035 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:29.816958904 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:29.985574961 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:29.991425991 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:29.996825933 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.559631109 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:30.571309090 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.591052055 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:30.603988886 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.760723114 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.762240887 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:30.771295071 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.860403061 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:30.861844063 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:30.866995096 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:33.062648058 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:33.106268883 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:33.140732050 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:33.140782118 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.528486013 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.573357105 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.575601101 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.607595921 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.607645988 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.623306036 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.747123957 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.769680977 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.785325050 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.785372972 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.824065924 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.870953083 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.872685909 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.919003010 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.970999956 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:36.972441912 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:36.979768038 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.080174923 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.081706047 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:37.092370987 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.122231007 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:37.132421970 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.200447083 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:37.224667072 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.352873087 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.354521036 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:37.372704029 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.479780912 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:37.481183052 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:37.553625107 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:49.450423002 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:49.455301046 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:49.627656937 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:26:49.630042076 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:26:49.635335922 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:01.701915026 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:01.706892014 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:01.875888109 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:01.877504110 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:01.882328033 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:02.895216942 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:02.950021982 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:08.028451920 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:08.340676069 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:08.950084925 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:09.070391893 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:09.070406914 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:09.070449114 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:09.230503082 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:09.233437061 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:09.238329887 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:11.309760094 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:11.314702988 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:11.483814955 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:11.485486031 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:11.490802050 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:13.622132063 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:13.627018929 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:13.795808077 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:13.797724009 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:13.802609921 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:14.481646061 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:14.486681938 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:14.655731916 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:14.657329082 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:14.662102938 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:14.981848955 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:14.986680031 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:15.184089899 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:15.185755014 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:15.190526962 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:21.747807026 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:21.752643108 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:21.922348022 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:21.924061060 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:21.928929090 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:23.341018915 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:23.345885992 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:23.585573912 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:23.587317944 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:23.592144012 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:29.247245073 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:29.252290964 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:29.421108961 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:29.423307896 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:29.428169966 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:32.888557911 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:32.934523106 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:34.122185946 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:34.147551060 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:34.313786030 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:34.315423012 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:34.320261002 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.216075897 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.220829964 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.262924910 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.267725945 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.294337988 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.299163103 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.387830973 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.390069008 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.392965078 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.393018007 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.398206949 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.465979099 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.470834970 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.480305910 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.483418941 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.530867100 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.544045925 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.548933983 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.559705019 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.565218925 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.576962948 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.581629992 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.626708984 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.652220964 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.654038906 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.658852100 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.747754097 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.749615908 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.755800009 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.843024015 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.844645023 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.849515915 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.936341047 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:44.938126087 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:44.942897081 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:48.466072083 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:48.470839024 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:48.640042067 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:48.647336006 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:48.653250933 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:49.669336081 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:49.677615881 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:49.846196890 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:49.848023891 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:49.852859974 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:58.637911081 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:58.645684004 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:58.815359116 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:27:58.818388939 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:27:58.823740005 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:00.887950897 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:28:00.892822981 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:01.301630020 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:01.302345991 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:28:01.303044081 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:01.303100109 CEST	49717	50000	192.168.2.6	191.96.207.180
Sep 24, 2024 19:28:01.310250044 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:02.917782068 CEST	50000	49717	191.96.207.180	192.168.2.6
Sep 24, 2024 19:28:02.965650082 CEST	49717	50000	192.168.2.6	191.96.207.180

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:24:14.175878048 CEST	55642	53	192.168.2.6	1.1.1.1
Sep 24, 2024 19:24:14.186742067 CEST	53	55642	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 24, 2024 19:24:14.175878048 CEST	192.168.2.6	1.1.1.1	0x9ba6	Standard query (0)	vecotr.viewdns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 24, 2024 19:24:14.186742067 CEST	1.1.1.1	192.168.2.6	0x9ba6	No error (0)	vecotr.viewdns.net		191.96.207.180	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:23:51
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\84Z63SyEQ7.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2313087322.000001A998460000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2280796718.000001A9821C7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2280796718.000001A980368000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2280796718.000001A981B65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:23:51
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:24:05
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:24:05
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x5d0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.4591457992.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.4602231795.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD347741FA Relevance: 1.8, Strings: 1, Instructions: 554COMMON

Download Yara Rule

Strings

9P_H, xrefs: 00007FFD347745A4

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID: 9P_H
API String ID: 0-2248134334
Opcode ID: ee434ab78d553616101b35eb3d1e8cdfb717d04baa369858a65846b1619c0228
Instruction ID: d6d136275b98aa61209ee2d72e6989e523aa28ac87341b588ac62d87e3f9f5e3
Opcode Fuzzy Hash: ee434ab78d553616101b35eb3d1e8cdfb717d04baa369858a65846b1619c0228
Instruction Fuzzy Hash: EFF16A7170CA458FE795EB1C88E5AB57BE1FF96310B4440BED1CAC7193DA69B842C780

Function 00007FFD3484251D Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317818616.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e6e82fc280b7509b5bc7dfe193fb543cccaddae2bf59ef90d66230bdfe157f
Instruction ID: 06566fe17a17fcaa0dcb22f66c231ea96bf3f7f533a7503d45d5bb159c0cd0a7
Opcode Fuzzy Hash: c1e6e82fc280b7509b5bc7dfe193fb543cccaddae2bf59ef90d66230bdfe157f
Instruction Fuzzy Hash: EAE14931B0DB890FE7999B2858A52B53BD1EF5B354F0801FFD589C72A3DA1DA802C341

Function 00007FFD3477C558 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69d7ba44c123c4b587ec6fc6bcf2f1857e05943df0ac09f0467ee9838addcba
Instruction ID: 5dfab7c1fb1febb6277a02d0337c9eae453b7c5e8bb2da981f78d312866beffe
Opcode Fuzzy Hash: c69d7ba44c123c4b587ec6fc6bcf2f1857e05943df0ac09f0467ee9838addcba
Instruction Fuzzy Hash: F3411970A18A5D8FDF88EF98D8A56EDB7F1FF59305F10016AE509E7291CB35A840CB80

Function 00007FFD3484269E Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317818616.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f790ad1bca02ed5ddde4fad235ad6059160ef3b60509f9c2bc6fb476304d5d2f
Instruction ID: 9469051ecfea2a2e5ec9cfacd884a70ae7f565e87bed484d5b17729725da326b
Opcode Fuzzy Hash: f790ad1bca02ed5ddde4fad235ad6059160ef3b60509f9c2bc6fb476304d5d2f
Instruction Fuzzy Hash: 2111D332B1CA0A0FEB989B1C54B127A73C2EF8A355B44017FD64EC32A3DE1AE8025304

Function 00007FFD347739B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 7d4851e2e39aebfbd3225861672050b8a40e95cb72be33ff8f515fabaec94839
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: AF01677121CB0C8FD744EF0CE451AB5B7E0FB95364F50056DE58AC3651D636E882CB45

Function 00007FFD3477C0F5 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810bedd73f5f43de44ed4c0fe52302f8c1b9231732d9433a994c932c43041621
Instruction ID: 4da285bd7e049f17049083eb19d2838cd48514236442bed6126295019824a058
Opcode Fuzzy Hash: 810bedd73f5f43de44ed4c0fe52302f8c1b9231732d9433a994c932c43041621
Instruction Fuzzy Hash: 10012C7091464C9FCF84EF58C859AEA7BF0FF29305F4141AAD409D7261DB35E554CB80

Function 00007FFD348419B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317818616.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1754ee4d062b58073ab30dbf83e8c6e6c53113f2715f397d95cf1f228e0a89
Instruction ID: 165e1239e045e0c78589fdd23afe8614b06c32a4e5b3eb7930b54a44661be9b7
Opcode Fuzzy Hash: 1e1754ee4d062b58073ab30dbf83e8c6e6c53113f2715f397d95cf1f228e0a89
Instruction Fuzzy Hash: A1F0E023F0DE5A0AF6A5929C24691F467C1DF9B331B840376D65DD32D7DC0558220285

Function 00007FFD3477C110 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c374fbf35d6e38e32050732a1b414b35d631ea0383f98fd6aa93ae95f330787
Instruction ID: 9797ff828e7d382d72b9a51e90bed2bf29b6396d9e3a66a8c8cfaf505f6b4d19
Opcode Fuzzy Hash: 0c374fbf35d6e38e32050732a1b414b35d631ea0383f98fd6aa93ae95f330787
Instruction Fuzzy Hash: 3BF0C970914A4C9FCF84EF58C899AE97BE0FB68305F40456AA40DD3250DB31A594CB81

Function 00007FFD3477C935 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f748d57f1e31ab7814b9bf27c6f2afd43c0df518a48e8f5ba2c67efbebfab82
Instruction ID: 06d8cbac60ce59e4c28ed0b8f53be155ceb93fa70bf887e3cf5b72398d81cef2
Opcode Fuzzy Hash: 5f748d57f1e31ab7814b9bf27c6f2afd43c0df518a48e8f5ba2c67efbebfab82
Instruction Fuzzy Hash: 9DE08670F086478FE794DB1488613BDBAA1BF4A318F5082B9D55DD6283CB7D78C45B81

Non-executed Functions

Function 00007FFD34773EF5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091e4bdfaf81f3536d3ccd287288c3ce29d3110ba882f11b2b71beed915f3a8c
Instruction ID: febefc3187a5b9e254ad1e37514ef21c4e31dcf013b6d06b1b492c1589151ef4
Opcode Fuzzy Hash: 091e4bdfaf81f3536d3ccd287288c3ce29d3110ba882f11b2b71beed915f3a8c
Instruction Fuzzy Hash: AC518697B0D6929BE312966CA8F60FA3FA4DF8327874941B3C5C4CA093ED4C6457E291

Function 00007FFD34773F53 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834e72ea9f2c8ff07cddc07d9022d4c6943586f903704c612cf7259705d77ad8
Instruction ID: dfd486d58c3e78274fb81af70adf0e85a05b013e74020a3ac882e4531f41a581
Opcode Fuzzy Hash: 834e72ea9f2c8ff07cddc07d9022d4c6943586f903704c612cf7259705d77ad8
Instruction Fuzzy Hash: C5517797B0D6929BE311966CA8F70EA3BD4EF8327974941B3C5C4CE053EE4C245BA191

Function 00007FFD34773CFA Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a95042896308847050c1cb98808dd8c323ae23d47a804f919ab4a3b9ecd2ec
Instruction ID: ba192e55ae129818f356130a2939bf5f9364632a23269c9cd716dd82edd910ae
Opcode Fuzzy Hash: b2a95042896308847050c1cb98808dd8c323ae23d47a804f919ab4a3b9ecd2ec
Instruction Fuzzy Hash: 8941A68BB0D6D29AE653012D5CB60E93F94DE93225B49C4F7C6C4CA0939E4D2C4BE2A1

Function 00007FFD347740F2 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170767ba62aa69aa0b433d59968b346c62ac043114502eccd03894daac53af0f
Instruction ID: bc8e65e1f2add1dd5e16a6cab6b729a927c38035f8381ddd1da47dddd1b0b808
Opcode Fuzzy Hash: 170767ba62aa69aa0b433d59968b346c62ac043114502eccd03894daac53af0f
Instruction Fuzzy Hash: 1141979BA0D6D29BE752962C5CF61E63FE4DFA326474940B7C6C4CE053D94C38079391

Function 00007FFD3477DCFD Relevance: 5.1, Strings: 4, Instructions: 149COMMON

Download Yara Rule

Strings

:, xrefs: 00007FFD3477DD0A
&, xrefs: 00007FFD3477F0FB
5N_H, xrefs: 00007FFD3477EF70
L, xrefs: 00007FFD3477D95A

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID: &$5N_H$:$L
API String ID: 0-3132655339
Opcode ID: bab9552f3434c665ba4009095b1a7427e62bac2627865d672c0678b9afe93a7e
Instruction ID: 365952076aa68b589bec3b8d6606181e177b7db8199310fa470cc50bcfd03b3d
Opcode Fuzzy Hash: bab9552f3434c665ba4009095b1a7427e62bac2627865d672c0678b9afe93a7e
Instruction Fuzzy Hash: 6A513CB0E14A19CFEBA4DF08CCA57A8B7A5EB99301F4080F9D50DD7291DE796E818F40

Function 00007FFD3477F403 Relevance: 5.1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD3477F439
", xrefs: 00007FFD3477F471
8, xrefs: 00007FFD3477F49E
L, xrefs: 00007FFD3477D95A

Memory Dump Source

Source File: 00000000.00000002.2317277073.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID: "$8$@$L
API String ID: 0-426383896
Opcode ID: 8daa0285c72165cb1127256613fe5349c27f4b63a902e79ad49212e805683722
Instruction ID: d2a5b34829077ca1372360c55d0fb45b2a46aabb4679e16b36158c6e3a39ce3c
Opcode Fuzzy Hash: 8daa0285c72165cb1127256613fe5349c27f4b63a902e79ad49212e805683722
Instruction Fuzzy Hash: 3A216D70A08619CFDB64DF04C8A87A8B7B1EF8A305F5041EDD50DDB291CBBA6980CF85

Analysis Process: RegSvcs.exePID: 6544, Parent PID: 1340COMMON

Execution Graph

Execution Coverage:	16.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	57
Total number of Limit Nodes:	7

Executed Functions

Function 026F80C8 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.4601506616.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_26f0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972a3bb3f34ddb37deb1e8cbe5098e68527ef7f01ea620439137e547371b624b
Instruction ID: f620cf44a118f36e59f8f96af395c1139886a5a81bca3a439927bf76576c3058
Opcode Fuzzy Hash: 972a3bb3f34ddb37deb1e8cbe5098e68527ef7f01ea620439137e547371b624b
Instruction Fuzzy Hash: F441F132D0475A8FCB04DFA9D8446AEFBF1EF89310F1486AAD504A7351DB74A845CBE0

Function 026F8198 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,026F811A), ref: 026F8207

Memory Dump Source

Source File: 00000004.00000002.4601506616.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_26f0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 97b95b71d33b4c8a3200e01d669f7a7ab58f4eb08bbeb81b82eaf7f409f6712b
Instruction ID: d22aa3f399769cfb0608e983de627b711d4877a26eca224f8fc0c8b290cb3031
Opcode Fuzzy Hash: 97b95b71d33b4c8a3200e01d669f7a7ab58f4eb08bbeb81b82eaf7f409f6712b
Instruction Fuzzy Hash: 231106B1C0065ADBDB10CF9AC544BDEFBB4AF48324F10815AD518B7250D778A954CFE5

Function 026F7CB8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,026F811A), ref: 026F8207

Memory Dump Source

Source File: 00000004.00000002.4601506616.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_26f0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 516e1fae23b1777d0b05046300aeeb09613d65c9f1606977967020b358ced2d4
Instruction ID: 4bcd75f44458f3cbb91301f3881a325685cc57305cc562de7b12d202b2b40d87
Opcode Fuzzy Hash: 516e1fae23b1777d0b05046300aeeb09613d65c9f1606977967020b358ced2d4
Instruction Fuzzy Hash: D51106B1C0065ADFDB10DF9AC5447DEFBF4AF48220F10816AE518A7240D778A954CFE5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 84Z63SyEQ7.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kd2fd5ey.qiu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxxvivap.sdx.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UEK2DMRH2GD3AT5SXHI3.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
84Z63SyEQ7.ps1

Function 026F80C8 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Function 026F8198 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 026F7CB8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON