Edit tour
Windows
Analysis Report
1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe
Overview
General Information
| Sample name: | 1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Analysis ID: | 1520417 |
| MD5: | b046211fe3f420a9ceb7663a560ece96 |
| SHA1: | 785a1cff39f2a75cbfffed3d718e9e026b3c80a1 |
| SHA256: | 96134c810750cc56e372551f8070f06aee80ae0cc8eeac983502d6b8f66c77df |
| Tags: | base64-decodedexeuser-abuse_ch |
| Infos: |  |
 | |
Detection
Snake Keylogger, VIP Keylogger
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe (PID: 6764 cmdline: "C:\Users\ user\Deskt op\1727426 286cf46967 5e3a7fae43 b5e2efcc15 639ae08e50 67de36f312 9e2eb67816 8920527172 .dat-decod ed.exe" MD5: B046211FE3F420A9CEB7663A560ECE96) 
WerFault.exe (PID: 7608 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 764 -s 262 0 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| 404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"Exfil Mode": "SMTP", "Email ID": "info@lamela.si", "Password": "2014viks5961lamela", "Host": "mail.lamela.si", "Port": "587", "Version": "4.4"}{"Exfil Mode": "SMTP", "Username": "info@lamela.si", "Password": "2014viks5961lamela", "Host": "mail.lamela.si", "Port": "587", "Version": "4.4"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
| JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
| Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
| Click to see the 2 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
| JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
| Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
| JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
| Click to see the 4 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
| JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
| Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
| Click to see the 2 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-09-27T10:47:31.786222+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.7 | 49701 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:32.974719+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.7 | 49703 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:34.175636+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.7 | 49705 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:38.978463+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.7 | 49713 | 188.114.97.3 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-09-27T10:47:30.112737+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49699 | 158.101.44.242 | 80 | TCP |
| 2024-09-27T10:47:31.175032+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49699 | 158.101.44.242 | 80 | TCP |
| 2024-09-27T10:47:32.424999+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49702 | 158.101.44.242 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | URL Reputation: | ||
| Source: | URL Reputation: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
Location Tracking | |
|---|
| Source: | DNS query: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00ECF62F | |
| Source: | Code function: | 0_2_00ECFA88 | |
| Source: | Code function: | 0_2_067020A8 | |
| Source: | Code function: | 0_2_06701970 | |
| Source: | Code function: | 0_2_0670E950 | |
| Source: | Code function: | 0_2_06700673 | |
| Source: | Code function: | 0_2_0670F658 | |
| Source: | Code function: | 0_2_0670C690 | |
| Source: | Code function: | 0_2_0670D7F0 | |
| Source: | Code function: | 0_2_0670E4F8 | |
| Source: | Code function: | 0_2_0670C238 | |
| Source: | Code function: | 0_2_0670F200 | |
| Source: | Code function: | 0_2_067023EE | |
| Source: | Code function: | 0_2_0670D398 | |
| Source: | Code function: | 0_2_06700040 | |
| Source: | Code function: | 0_2_0670E0A0 | |
| Source: | Code function: | 0_2_0670CF40 | |
| Source: | Code function: | 0_2_0670DC48 | |
| Source: | Code function: | 0_2_0670BDE0 | |
| Source: | Code function: | 0_2_0670EDA8 | |
| Source: | Code function: | 0_2_0670CAE8 | |
| Source: | Code function: | 0_2_0670FAB0 | |
| Source: | Code function: | 0_2_06700853 | |
Networking | |
|---|
| Source: | DNS query: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_00ECC146 | |
| Source: | Code function: | 0_2_00ECD278 | |
| Source: | Code function: | 0_2_00EC5362 | |
| Source: | Code function: | 0_2_00ECC468 | |
| Source: | Code function: | 0_2_00ECC738 | |
| Source: | Code function: | 0_2_00EC29E0 | |
| Source: | Code function: | 0_2_00EC69A0 | |
| Source: | Code function: | 0_2_00ECE988 | |
| Source: | Code function: | 0_2_00ECCA08 | |
| Source: | Code function: | 0_2_00ECCCD8 | |
| Source: | Code function: | 0_2_00EC9DE0 | |
| Source: | Code function: | 0_2_00EC6FC8 | |
| Source: | Code function: | 0_2_00ECCFAA | |
| Source: | Code function: | 0_2_00ECF62F | |
| Source: | Code function: | 0_2_00ECE97A | |
| Source: | Code function: | 0_2_00ECFA88 | |
| Source: | Code function: | 0_2_00EC3E09 | |
| Source: | Code function: | 0_2_06708688 | |
| Source: | Code function: | 0_2_06701288 | |
| Source: | Code function: | 0_2_06704168 | |
| Source: | Code function: | 0_2_06708D58 | |
| Source: | Code function: | 0_2_06700BA8 | |
| Source: | Code function: | 0_2_06701970 | |
| Source: | Code function: | 0_2_0670E950 | |
| Source: | Code function: | 0_2_0670F658 | |
| Source: | Code function: | 0_2_0670F649 | |
| Source: | Code function: | 0_2_0670C690 | |
| Source: | Code function: | 0_2_0670C680 | |
| Source: | Code function: | 0_2_0670D7F0 | |
| Source: | Code function: | 0_2_0670D7EF | |
| Source: | Code function: | 0_2_0670E4F8 | |
| Source: | Code function: | 0_2_0670E4E8 | |
| Source: | Code function: | 0_2_0670127A | |
| Source: | Code function: | 0_2_0670C238 | |
| Source: | Code function: | 0_2_0670F200 | |
| Source: | Code function: | 0_2_0670D398 | |
| Source: | Code function: | 0_2_0670D38A | |
| Source: | Code function: | 0_2_06700040 | |
| Source: | Code function: | 0_2_0670E0A0 | |
| Source: | Code function: | 0_2_0670E091 | |
| Source: | Code function: | 0_2_06704159 | |
| Source: | Code function: | 0_2_0670F1F0 | |
| Source: | Code function: | 0_2_0670CF40 | |
| Source: | Code function: | 0_2_0670CF31 | |
| Source: | Code function: | 0_2_0670CF3F | |
| Source: | Code function: | 0_2_0670DC48 | |
| Source: | Code function: | 0_2_0670DC38 | |
| Source: | Code function: | 0_2_06707CE0 | |
| Source: | Code function: | 0_2_0670BDE0 | |
| Source: | Code function: | 0_2_0670BDCF | |
| Source: | Code function: | 0_2_0670EDA8 | |
| Source: | Code function: | 0_2_0670ED99 | |
| Source: | Code function: | 0_2_0670CAE8 | |
| Source: | Code function: | 0_2_0670CAD9 | |
| Source: | Code function: | 0_2_0670FAB0 | |
| Source: | Code function: | 0_2_0670FAA0 | |
| Source: | Code function: | 0_2_06700B97 | |
| Source: | Code function: | 0_2_06701962 | |
| Source: | Code function: | 0_2_0670E942 | |
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00EC9D55 | |
| Source: | Code function: | 0_2_06702701 | |
| Source: | Code function: | 0_2_067083AC | |
| Source: | Code function: | 0_2_067079A4 | |
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_06708688 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Disable or Modify Tools | 1 OS Credential Dumping | 1 Query Registry | Remote Services | 1 Email Collection | 1 Web Service | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 41 Virtualization/Sandbox Evasion | LSASS Memory | 21 Security Software Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | 1 Data from Local System | 3 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Deobfuscate/Decode Files or Information | NTDS | 41 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 1 System Network Configuration Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 13 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 66% | ReversingLabs | ByteCode-MSIL.Spyware.Snakekeylogger | ||
| 100% | Avira | HEUR/AGEN.1307591 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 100% | URL Reputation | malware | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 100% | URL Reputation | malware | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| reallyfreegeoip.org | 188.114.97.3 | true | true | unknown | |
| api.telegram.org | 149.154.167.220 | true | true | unknown | |
| checkip.dyndns.com | 158.101.44.242 | true | false | unknown | |
| checkip.dyndns.org | unknown | unknown | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| true |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| true |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | true | |
| 188.114.97.3 | reallyfreegeoip.org | European Union | 13335 | CLOUDFLARENETUS | true | |
| 158.101.44.242 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1520417 |
| Start date and time: | 2024-09-27 10:46:36 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 57s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 19 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.winEXE@2/5@3/3 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.168.117.173
- Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
- VT rate limit hit for: 1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe
| Time | Type | Description |
|---|---|---|
| 04:47:29 | API Interceptor | |
| 05:56:44 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 149.154.167.220 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger | Browse | |||
| Get hash | malicious | VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| 188.114.97.3 | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| 158.101.44.242 | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| reallyfreegeoip.org | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| checkip.dyndns.com | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| api.telegram.org | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| TELEGRAMRU | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Porn Scam | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | PureLog Stealer | Browse |
| |
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | PureLog Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| ORACLE-BMC-31898US | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | Snake Keylogger | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | PureLog Stealer | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
⊘No context
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2SSM3MSIR0DTTRQ2_504a3634ea5f948835717bb7b0f19bfc2412817f_35627730_24d8b2c5-b163-42cf-9ebb-b8dff9900c0d\Report.wer
Download File
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.2327646232540128 |
| Encrypted: | false |
| SSDEEP: | 192:S0CQMBYscDRb0BU/KaGyFuyRCzuiFWZ24IO8x:GwsoeBU/KaVPRCzuiFWY4IO8x |
| MD5: | 0BEB4EF1C4704A1F31B7B0FA9DE92B7D |
| SHA1: | AE8B8127BB80F96B7CB762EC21D736077143B5ED |
| SHA-256: | 45B41520305A46B60956289697C0530439614721C4351DAA9D9E8696E2D06C73 |
| SHA-512: | F25963BE024F3B6AA13B3F33DD7DD82E1F01F2A19AB00584F00EF57C02FF0EFB7F9738BA5DC033DC6987C2DE89719B73158846DB543E916BBBC6807924CD8BB5 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 335543 |
| Entropy (8bit): | 3.473875774787412 |
| Encrypted: | false |
| SSDEEP: | 3072:lEZr/wycCXaIoVT+JxJXfKdJGDbf4uEqeNWLTglOnThN:lEZEyraI+SJxJX+0bf4RUTgl6 |
| MD5: | 0F5BD37B2373B078F1F9CEE26E05C5F7 |
| SHA1: | 1F26272E18D4CD81C951EF0A7AA9A177C23BC3ED |
| SHA-256: | 9DF49C62914D66216A0EAF4EA77C1EFB72953EB486C91EDE77EECAFECAF1D21F |
| SHA-512: | 9BB000B7EFA8656CC36E7A1C7739450B32E7E74129F30A93E52D5A37822132B75934CF5895E8165DAEFEA85DCB38699A323F6C3DD806B6F264F94B243CC9549D |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8624 |
| Entropy (8bit): | 3.7081594073212356 |
| Encrypted: | false |
| SSDEEP: | 192:R6l7wVeJEW65nr6YNRSUplgmfZJEGprq89bm7sfiAim:R6lXJ965nr6YLSUplgmfkYmAfiE |
| MD5: | 9218E65E651B96FB56284C70B7846E8D |
| SHA1: | 05DDE774538188B9350CDCDCC1A47A6D10E59914 |
| SHA-256: | 6FDB882B8AC448C577DB01C7A4941674C641491EC7182F795DAB0671901EE65E |
| SHA-512: | E1C8F6F809E80A644603DDAD9A62A45887CE949974F70270343BD2E5AB8FDBC1C6D1C5567DA8512BE47B824FD0F86929C6D94A7503273C9B2763E9B440E26581 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5004 |
| Entropy (8bit): | 4.600265148840576 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zsYJg77aI99qWpW8VYjkjYm8M4JxYoJFb+q8vXSQAxfQfLId:uIjfeI7DL7VR2JxjKijfQfkd |
| MD5: | 0C05A3147DC08149272D34C23FA287C1 |
| SHA1: | 79A0E8406B3A48F350168789609867414E899DAE |
| SHA-256: | 5DAADCE804753D8695F06D44D6DBA8B877C9C56E1032A0E8A05B3A568FD7776C |
| SHA-512: | 4B52A90F8FB4E2D8962578DCB741525C643039D083996B658C0DA3C561DCB02120235858776813D2FBE1A6F6D6A3440D9BD9D62D72E938FB807725A129E21B2A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.417255435985839 |
| Encrypted: | false |
| SSDEEP: | 6144:4cifpi6ceLPL9skLmb0mQSWSPtaJG8nAgex285i2MMhA20X4WABlGuNA5+:ti58QSWIZBk2MM6AFB6o |
| MD5: | A3DC8F5250BDA2178B2C6C31AD33C0DD |
| SHA1: | F7898F19AEAF1894F9371D27F04F20D2FE5D3846 |
| SHA-256: | 9DB665242E5B184AB23472620E2DF3F79D584AE63B2F9B3BA4EAF73F1242934D |
| SHA-512: | DAAA423F857C05BD148734E543C97ACA0A7608B8ABCFA3CC39DADD4AF22330F3C76F306870A3601768AF63EC978E8931035E1F928C739649A09D2CB037545AED |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.61892036333007 |
| TrID: |
|
| File name: | 1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| File size: | 279'040 bytes |
| MD5: | b046211fe3f420a9ceb7663a560ece96 |
| SHA1: | 785a1cff39f2a75cbfffed3d718e9e026b3c80a1 |
| SHA256: | 96134c810750cc56e372551f8070f06aee80ae0cc8eeac983502d6b8f66c77df |
| SHA512: | 5a0fc701606682de24dfc1b8408b6d7c13205952128b211b9b7ef11a97871f2590d7c705b4032eab6a5661a1295fe4bc8bb58418b68e999e8fdd315009ca7eb3 |
| SSDEEP: | 3072:lL6hDp5qqQjolo+XgVfXACCBc9jKnfL83mwnbItgQ2eXPs0lUY/VgMiObbY:gn5wnb+gWxb |
| TLSH: | 7654841D2BD49810E2FF8977C2B65125C6BBB4A346258D3E16D1E81A3F3E580DE06F63 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............P..,...........K... ...`....@.. ....................................@................................ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x444b0e |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x669085D9 [Fri Jul 12 01:24:41 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x44abc | 0x4f | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x46000 | 0x1017 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x48000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0x42b14 | 0x42c00 | d36eabe48ced213e9155dfdc9f9efb9b | False | 0.21219935042134833 | SysEx File - | 5.620523978083059 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x46000 | 0x1017 | 0x1200 | 78b97a769c57cf460625c961b04b1a16 | False | 0.3543836805555556 | data | 4.76801789588623 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x48000 | 0xc | 0x200 | 0f43dd090ca3c812d8980b8f7ea3aff8 | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x460a0 | 0x31c | data | 0.4271356783919598 | ||
| RT_MANIFEST | 0x463bc | 0xc5b | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.3926651912741069 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-09-27T10:47:30.112737+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49699 | 158.101.44.242 | 80 | TCP |
| 2024-09-27T10:47:31.175032+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49699 | 158.101.44.242 | 80 | TCP |
| 2024-09-27T10:47:31.786222+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.7 | 49701 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:32.424999+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49702 | 158.101.44.242 | 80 | TCP |
| 2024-09-27T10:47:32.974719+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.7 | 49703 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:34.175636+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.7 | 49705 | 188.114.97.3 | 443 | TCP |
| 2024-09-27T10:47:38.978463+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.7 | 49713 | 188.114.97.3 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 27, 2024 10:47:29.289355993 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:29.294223070 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:29.294298887 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:29.294574976 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:29.299377918 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:29.910844088 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:29.915019035 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:29.919962883 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.066852093 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.112736940 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:30.136713028 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.136749983 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.136864901 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.146043062 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.146065950 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.625891924 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.626159906 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.632381916 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.632405043 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.632764101 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.675134897 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.684118032 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.731405973 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.793179989 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.793287039 CEST | 443 | 49700 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.793457031 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.881700993 CEST | 49700 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:30.931173086 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:30.936080933 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.133038044 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.161760092 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.161828041 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.161896944 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.162229061 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.162242889 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.175031900 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.637057066 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.639826059 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.639852047 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.786241055 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.786345959 CEST | 443 | 49701 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.786427975 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.786958933 CEST | 49701 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:31.790143013 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.791419029 CEST | 49702 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.795178890 CEST | 80 | 49699 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.795254946 CEST | 49699 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.796174049 CEST | 80 | 49702 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:31.796246052 CEST | 49702 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.796327114 CEST | 49702 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:31.801064014 CEST | 80 | 49702 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.371851921 CEST | 80 | 49702 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.373430014 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.373490095 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.373590946 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.374156952 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.374170065 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.424998999 CEST | 49702 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:32.828816891 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.830460072 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.830507040 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.974735022 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.974839926 CEST | 443 | 49703 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.975406885 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.975406885 CEST | 49703 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:32.986876965 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:32.991719961 CEST | 80 | 49704 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:32.991813898 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:32.991928101 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:32.996674061 CEST | 80 | 49704 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:33.550592899 CEST | 80 | 49704 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:33.572843075 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:33.572876930 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:33.572962999 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:33.573266983 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:33.573282003 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:33.596935034 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.026843071 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.028311014 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.028331041 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.175647020 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.175740957 CEST | 443 | 49705 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.175826073 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.176317930 CEST | 49705 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.180111885 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.181030989 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.185777903 CEST | 80 | 49704 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.185805082 CEST | 80 | 49706 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.185837984 CEST | 49704 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.185878992 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.186002016 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:34.190718889 CEST | 80 | 49706 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.808716059 CEST | 80 | 49706 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.810134888 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.810172081 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.810710907 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.810878992 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:34.810890913 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:34.862544060 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.264621973 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.266185999 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.266206980 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.396303892 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.396394014 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.396725893 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.398876905 CEST | 49707 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.400235891 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.402873039 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.405550957 CEST | 80 | 49706 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.405693054 CEST | 49706 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.407744884 CEST | 80 | 49708 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.408276081 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.408276081 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:35.413117886 CEST | 80 | 49708 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.977077961 CEST | 80 | 49708 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.980223894 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.980320930 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:35.980437994 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.980648994 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:35.980703115 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.018847942 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.462778091 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.464505911 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:36.464567900 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.605624914 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.605731964 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.605878115 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:36.606385946 CEST | 49709 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:36.610336065 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.611804962 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.615848064 CEST | 80 | 49708 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.615930080 CEST | 49708 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.616642952 CEST | 80 | 49710 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:36.616760015 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.616889000 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:36.621675968 CEST | 80 | 49710 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.193453074 CEST | 80 | 49710 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.194915056 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.194961071 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.195056915 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.195342064 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.195353985 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.237560034 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.651527882 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.653767109 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.653790951 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.809432983 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.809535980 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.809735060 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.813569069 CEST | 49711 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:37.817173004 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.818133116 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.822211981 CEST | 80 | 49710 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.822298050 CEST | 49710 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.822922945 CEST | 80 | 49712 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:37.822981119 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.823101044 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:37.827879906 CEST | 80 | 49712 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.380419970 CEST | 80 | 49712 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.381710052 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.381761074 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.381846905 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.382083893 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.382101059 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.425038099 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.848473072 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.850053072 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.850075006 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.978490114 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.978576899 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.978744030 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.979319096 CEST | 49713 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:38.982295036 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.983707905 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.987600088 CEST | 80 | 49712 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.987685919 CEST | 49712 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.988531113 CEST | 80 | 49714 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:38.988617897 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.988795996 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:38.993808031 CEST | 80 | 49714 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:39.775293112 CEST | 80 | 49714 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:39.776839972 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:39.776890039 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:39.776989937 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:39.777273893 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:39.777287006 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:39.787242889 CEST | 80 | 49714 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:39.787352085 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:40.241466045 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.243092060 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:40.243129015 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.382785082 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.382885933 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.382958889 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:40.383538961 CEST | 49715 | 443 | 192.168.2.7 | 188.114.97.3 |
| Sep 27, 2024 10:47:40.408776045 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:40.414033890 CEST | 80 | 49714 | 158.101.44.242 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.414115906 CEST | 49714 | 80 | 192.168.2.7 | 158.101.44.242 |
| Sep 27, 2024 10:47:40.417251110 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:40.417285919 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.417619944 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:40.417764902 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:40.417778969 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.044646025 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.044835091 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:41.048450947 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:41.048461914 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.048892021 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.050518990 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:41.091401100 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.347111940 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.347197056 CEST | 443 | 49716 | 149.154.167.220 | 192.168.2.7 |
| Sep 27, 2024 10:47:41.347388029 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:41.366692066 CEST | 49716 | 443 | 192.168.2.7 | 149.154.167.220 |
| Sep 27, 2024 10:47:41.799312115 CEST | 49702 | 80 | 192.168.2.7 | 158.101.44.242 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 27, 2024 10:47:29.275546074 CEST | 53708 | 53 | 192.168.2.7 | 1.1.1.1 |
| Sep 27, 2024 10:47:29.283811092 CEST | 53 | 53708 | 1.1.1.1 | 192.168.2.7 |
| Sep 27, 2024 10:47:30.127849102 CEST | 49722 | 53 | 192.168.2.7 | 1.1.1.1 |
| Sep 27, 2024 10:47:30.136090040 CEST | 53 | 49722 | 1.1.1.1 | 192.168.2.7 |
| Sep 27, 2024 10:47:40.409476995 CEST | 55169 | 53 | 192.168.2.7 | 1.1.1.1 |
| Sep 27, 2024 10:47:40.416456938 CEST | 53 | 55169 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Sep 27, 2024 10:47:29.275546074 CEST | 192.168.2.7 | 1.1.1.1 | 0xb14 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 27, 2024 10:47:30.127849102 CEST | 192.168.2.7 | 1.1.1.1 | 0x7ded | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 27, 2024 10:47:40.409476995 CEST | 192.168.2.7 | 1.1.1.1 | 0xb10d | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:29.283811092 CEST | 1.1.1.1 | 192.168.2.7 | 0xb14 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:30.136090040 CEST | 1.1.1.1 | 192.168.2.7 | 0x7ded | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:30.136090040 CEST | 1.1.1.1 | 192.168.2.7 | 0x7ded | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false | ||
| Sep 27, 2024 10:47:40.416456938 CEST | 1.1.1.1 | 192.168.2.7 | 0xb10d | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49699 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:29.294574976 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:29.910844088 CEST | 320 | IN | |
| Sep 27, 2024 10:47:29.915019035 CEST | 127 | OUT | |
| Sep 27, 2024 10:47:30.066852093 CEST | 320 | IN | |
| Sep 27, 2024 10:47:30.931173086 CEST | 127 | OUT | |
| Sep 27, 2024 10:47:31.133038044 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49702 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:31.796327114 CEST | 127 | OUT | |
| Sep 27, 2024 10:47:32.371851921 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49704 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:32.991928101 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:33.550592899 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49706 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:34.186002016 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:34.808716059 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.7 | 49708 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:35.408276081 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:35.977077961 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.7 | 49710 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:36.616889000 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:37.193453074 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.7 | 49712 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:37.823101044 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:38.380419970 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.7 | 49714 | 158.101.44.242 | 80 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 27, 2024 10:47:38.988795996 CEST | 151 | OUT | |
| Sep 27, 2024 10:47:39.775293112 CEST | 320 | IN | |
| Sep 27, 2024 10:47:39.787242889 CEST | 320 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49700 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:30 UTC | 84 | OUT | |
| 2024-09-27 08:47:30 UTC | 681 | IN | |
| 2024-09-27 08:47:30 UTC | 340 | IN | |
| 2024-09-27 08:47:30 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49701 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:31 UTC | 60 | OUT | |
| 2024-09-27 08:47:31 UTC | 685 | IN | |
| 2024-09-27 08:47:31 UTC | 340 | IN | |
| 2024-09-27 08:47:31 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49703 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:32 UTC | 60 | OUT | |
| 2024-09-27 08:47:32 UTC | 681 | IN | |
| 2024-09-27 08:47:32 UTC | 340 | IN | |
| 2024-09-27 08:47:32 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49705 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:34 UTC | 60 | OUT | |
| 2024-09-27 08:47:34 UTC | 681 | IN | |
| 2024-09-27 08:47:34 UTC | 340 | IN | |
| 2024-09-27 08:47:34 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.7 | 49707 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:35 UTC | 84 | OUT | |
| 2024-09-27 08:47:35 UTC | 675 | IN | |
| 2024-09-27 08:47:35 UTC | 340 | IN | |
| 2024-09-27 08:47:35 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.7 | 49709 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:36 UTC | 84 | OUT | |
| 2024-09-27 08:47:36 UTC | 675 | IN | |
| 2024-09-27 08:47:36 UTC | 340 | IN | |
| 2024-09-27 08:47:36 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.7 | 49711 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:37 UTC | 84 | OUT | |
| 2024-09-27 08:47:37 UTC | 671 | IN | |
| 2024-09-27 08:47:37 UTC | 340 | IN | |
| 2024-09-27 08:47:37 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.7 | 49713 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:38 UTC | 60 | OUT | |
| 2024-09-27 08:47:38 UTC | 675 | IN | |
| 2024-09-27 08:47:38 UTC | 340 | IN | |
| 2024-09-27 08:47:38 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.7 | 49715 | 188.114.97.3 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:40 UTC | 84 | OUT | |
| 2024-09-27 08:47:40 UTC | 671 | IN | |
| 2024-09-27 08:47:40 UTC | 340 | IN | |
| 2024-09-27 08:47:40 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.7 | 49716 | 149.154.167.220 | 443 | 6764 | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-27 08:47:41 UTC | 349 | OUT | |
| 2024-09-27 08:47:41 UTC | 344 | IN | |
| 2024-09-27 08:47:41 UTC | 55 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 04:47:27 |
| Start date: | 27/09/2024 |
| Path: | C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x700000 |
| File size: | 279'040 bytes |
| MD5 hash: | B046211FE3F420A9CEB7663A560ECE96 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 12 |
| Start time: | 04:47:41 |
| Start date: | 27/09/2024 |
| Path: | C:\Windows\SysWOW64\WerFault.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x720000 |
| File size: | 483'680 bytes |
| MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 18.6% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 71.4% |
| Total number of Nodes: | 28 |
| Total number of Limit Nodes: | 2 |
Graph
Function 00EC29E0 Relevance: 8.3, Strings: 6, Instructions: 844COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6FC8 Relevance: 6.8, Strings: 5, Instructions: 523COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC9DE0 Relevance: 6.1, Strings: 4, Instructions: 1134COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06704168 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06708D58 Relevance: 3.5, Strings: 1, Instructions: 2261COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC69A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECC146 Relevance: 2.7, Strings: 2, Instructions: 228COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC5362 Relevance: 2.7, Strings: 2, Instructions: 194COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECC468 Relevance: 2.7, Strings: 2, Instructions: 191COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECD278 Relevance: 2.7, Strings: 2, Instructions: 188COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECCA08 Relevance: 2.7, Strings: 2, Instructions: 187COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECCCD8 Relevance: 2.7, Strings: 2, Instructions: 186COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECCFAA Relevance: 2.7, Strings: 2, Instructions: 186COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECC738 Relevance: 2.7, Strings: 2, Instructions: 185COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06708688 Relevance: 1.9, APIs: 1, Instructions: 357COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06701970 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E950 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06701288 Relevance: .2, Instructions: 220COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 067020A8 Relevance: .2, Instructions: 220COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06700BA8 Relevance: .2, Instructions: 219COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 067023EE Relevance: .2, Instructions: 202COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06700B97 Relevance: .2, Instructions: 162COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECE97A Relevance: .2, Instructions: 150COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECE988 Relevance: .1, Instructions: 147COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670127A Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06701962 Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E942 Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC76F1 Relevance: 10.5, Strings: 8, Instructions: 474COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC8490 Relevance: 3.2, Strings: 2, Instructions: 702COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC5F38 Relevance: 2.8, Strings: 2, Instructions: 326COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECAEBA Relevance: 2.6, Strings: 2, Instructions: 128COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC9D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC0C8F Relevance: 1.8, Strings: 1, Instructions: 545COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06708A6C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECE007 Relevance: .7, Instructions: 654COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECE018 Relevance: .6, Instructions: 647COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC80D8 Relevance: .2, Instructions: 201COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECF3F1 Relevance: .2, Instructions: 150COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECD548 Relevance: .1, Instructions: 140COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC41A0 Relevance: .1, Instructions: 134COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECA303 Relevance: .1, Instructions: 124COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC9C30 Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC5658 Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC8370 Relevance: .1, Instructions: 91COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC8380 Relevance: .1, Instructions: 87COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC28F0 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6300 Relevance: .1, Instructions: 74COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC5649 Relevance: .1, Instructions: 69COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECAEF0 Relevance: .1, Instructions: 68COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC9761 Relevance: .1, Instructions: 65COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC62F0 Relevance: .1, Instructions: 62COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECF312 Relevance: .1, Instructions: 62COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC27F0 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECF320 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC5E98 Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECE8E8 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECABE0 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC9C29 Relevance: .0, Instructions: 32COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6739 Relevance: .0, Instructions: 19COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC28B0 Relevance: .0, Instructions: 19COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC28AB Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC8EF8 Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECAFAD Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6748 Relevance: .0, Instructions: 12COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC3E09 Relevance: 2.8, Strings: 2, Instructions: 300COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06707CE0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06700040 Relevance: .6, Instructions: 596COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECF62F Relevance: .3, Instructions: 274COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00ECFA88 Relevance: .3, Instructions: 272COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670F658 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670C238 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670F200 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670CAE8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670FAB0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670C690 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670CF40 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670D7F0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670D398 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670DC48 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E4F8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E0A0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670BDE0 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670EDA8 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06704159 Relevance: .2, Instructions: 225COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06700673 Relevance: .2, Instructions: 193COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06700853 Relevance: .1, Instructions: 116COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670CF31 Relevance: .1, Instructions: 103COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670FAA0 Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E4E8 Relevance: .1, Instructions: 100COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670F1F0 Relevance: .1, Instructions: 100COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670BDCF Relevance: .1, Instructions: 100COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670F649 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670CAD9 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670C680 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670DC38 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670E091 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670ED99 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670D38A Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670CF3F Relevance: .1, Instructions: 95COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0670D7EF Relevance: .1, Instructions: 95COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC2A69 Relevance: 5.1, Strings: 4, Instructions: 95COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00EC6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|