Windows
Analysis Report
yqEiP70L9q.exe
Overview
General Information
Sample name: | yqEiP70L9q.exerenamed because original name is a hash value |
Original sample name: | 30871d0e0185fcffd2d9452ffdd456f6.exe |
Analysis ID: | 1540485 |
MD5: | 30871d0e0185fcffd2d9452ffdd456f6 |
SHA1: | 9748cce9eabeacc79b7981066f3a1de20017c49b |
SHA256: | 579b87f1aee0d4dcddb5d3cc69ab2eb61af07a9f41da8a1a5c12453c219f85ba |
Tags: | 64exetrojan |
Infos: | |
Detection
Score: | 72 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- yqEiP70L9q.exe (PID: 6392 cmdline:
"C:\Users\ user\Deskt op\yqEiP70 L9q.exe" MD5: 30871D0E0185FCFFD2D9452FFDD456F6)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Sliver | According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army. | No Attribution |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
INDICATOR_TOOL_Sliver | Detects Sliver implant cross-platform adversary emulation/red team | ditekSHen |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Sliver | Yara detected Sliver Implants | Joe Security | ||
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
| |
JoeSecurity_Sliver | Yara detected Sliver Implants | Joe Security | ||
Multi_Trojan_Bishopsliver_42298c4a | unknown | unknown |
|
Click to jump to signature section
AV Detection |
---|
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Static PE information: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | Binary or memory string: | memstr_bc47efe3-3 |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Classification label: |
Source: | File opened: | Jump to behavior |
Source: | Static PE information: |
Source: | Key opened: | Jump to behavior |
Source: | ReversingLabs: |
Source: | File read: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Static PE information: |
Source: | Static file information: |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Thread injection, dropped files, key value created, disk infection and DNS query: |
Source: | Queries volume information: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 DLL Side-Loading | 11 Input Capture | 1 Security Software Discovery | Remote Services | 11 Input Capture | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 12 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
37% | ReversingLabs | Win64.Trojan.TangoMarte | ||
100% | Joe Sandbox ML |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
143.198.137.110 | unknown | United States | 15557 | LDCOMNETFR | false |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1540485 |
Start date and time: | 2024-10-23 20:28:11 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 29s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 5 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | yqEiP70L9q.exerenamed because original name is a hash value |
Original Sample Name: | 30871d0e0185fcffd2d9452ffdd456f6.exe |
Detection: | MAL |
Classification: | mal72.troj.winEXE@1/1@0/1 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- VT rate limit hit for: yqEiP70L9q.exe
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
LDCOMNETFR | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Okiru | Browse |
| ||
Get hash | malicious | Okiru | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Process: | C:\Users\user\Desktop\yqEiP70L9q.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 160 |
Entropy (8bit): | 4.438743916256937 |
Encrypted: | false |
SSDEEP: | 3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty |
MD5: | E467C82627F5E1524FDB4415AF19FC73 |
SHA1: | B86E3AA40E9FBED0494375A702EABAF1F2E56F8E |
SHA-256: | 116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540 |
SHA-512: | 2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A |
Malicious: | false |
Reputation: | moderate, very likely benign file |
Preview: |
File type: | |
Entropy (8bit): | 6.115106466563356 |
TrID: |
|
File name: | yqEiP70L9q.exe |
File size: | 19'317'248 bytes |
MD5: | 30871d0e0185fcffd2d9452ffdd456f6 |
SHA1: | 9748cce9eabeacc79b7981066f3a1de20017c49b |
SHA256: | 579b87f1aee0d4dcddb5d3cc69ab2eb61af07a9f41da8a1a5c12453c219f85ba |
SHA512: | 174a9861c6fcd6f77831fbfd4bd706e7dedfb7a0481725c2fd84663fa140cd1776e5e367a5b24028af2f7815f3fea6f198070e2967d67e81da802ea09f0cb59e |
SSDEEP: | 98304:oV5mfT7ZBbST4IzqTur8eXWuQrad5yd/ZBC6Ep/EqMLEIJMY:oV5mxBb3TreXWO5yd/ZBCTpcRb |
TLSH: | 41172A03E8D61195C9E9D1B489214262BA707C9C0B7963DF2B61F7B42F327F05EBA790 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........&.......".................`.........@...............................-...........`... ............................ |
Icon Hash: | 00928e8e8686b000 |
Entrypoint: | 0x45d260 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED |
DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x0 [Thu Jan 1 00:00:00 1970 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 6 |
OS Version Minor: | 1 |
File Version Major: | 6 |
File Version Minor: | 1 |
Subsystem Version Major: | 6 |
Subsystem Version Minor: | 1 |
Import Hash: | f0ea7b7844bbc5bfa9bb32efdcea957c |
Instruction |
---|
jmp 00007FC9D452D750h |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
pushfd |
cld |
dec eax |
sub esp, 000000E0h |
dec eax |
mov dword ptr [esp], edi |
dec eax |
mov dword ptr [esp+08h], esi |
dec eax |
mov dword ptr [esp+10h], ebp |
dec eax |
mov dword ptr [esp+18h], ebx |
dec esp |
mov dword ptr [esp+20h], esp |
dec esp |
mov dword ptr [esp+28h], ebp |
dec esp |
mov dword ptr [esp+30h], esi |
dec esp |
mov dword ptr [esp+38h], edi |
movups dqword ptr [esp+40h], xmm6 |
movups dqword ptr [esp+50h], xmm7 |
inc esp |
movups dqword ptr [esp+60h], xmm0 |
inc esp |
movups dqword ptr [esp+70h], xmm1 |
inc esp |
movups dqword ptr [esp+00000080h], xmm2 |
inc esp |
movups dqword ptr [esp+00000090h], xmm3 |
inc esp |
movups dqword ptr [esp+000000A0h], xmm4 |
inc esp |
movups dqword ptr [esp+000000B0h], xmm5 |
inc esp |
movups dqword ptr [esp+000000C0h], xmm6 |
inc esp |
movups dqword ptr [esp+000000D0h], xmm7 |
dec eax |
sub esp, 30h |
dec ecx |
mov ebp, ecx |
dec ecx |
mov edi, eax |
dec eax |
mov edx, dword ptr [01239A13h] |
dec eax |
mov edx, dword ptr [edx] |
dec eax |
cmp edx, 00000000h |
jne 00007FC9D453141Eh |
dec eax |
mov eax, 00000000h |
jmp 00007FC9D45314E3h |
dec eax |
mov edx, dword ptr [edx] |
dec eax |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x12ab000 | 0x490 | .idata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x12ac000 | 0x31b92 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x11fa040 | 0x148 | .data |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0xada58f | 0xada600 | bc0a7752638d1d446cbf9cf21ea0e602 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0xadc000 | 0x71d798 | 0x71d800 | 59669ab95ed32db8579e8c98780b0e02 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x11fa000 | 0xb04d0 | 0x41a00 | 31850976cb1b39201bceac9944bc3f38 | False | 0.3879724702380952 | data | 4.782356885965532 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.idata | 0x12ab000 | 0x490 | 0x600 | 2bda1f0c81dfae46ea8b9b606a4f3700 | False | 0.337890625 | data | 3.7631310752533804 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.reloc | 0x12ac000 | 0x31b92 | 0x31c00 | baa7cce747b2a94c769aa67386b8b189 | False | 0.13413257694723618 | data | 5.443883940323915 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
.symtab | 0x12de000 | 0x4 | 0x200 | 07b5472d347d42780469fb2654b7fc54 | False | 0.02734375 | data | 0.020393135236084953 | IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
DLL | Import |
---|---|
kernel32.dll | WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 23, 2024 20:29:11.746556044 CEST | 62851 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:12.388644934 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:12.389255047 CEST | 62851 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:12.552124023 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:12.552668095 CEST | 62851 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:13.044303894 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:13.044497967 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:13.534135103 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:14.145076036 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:14.183278084 CEST | 62852 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:14.514678955 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:14.808820009 CEST | 443 | 62852 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:14.809674025 CEST | 62852 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:14.972469091 CEST | 443 | 62852 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:14.972886086 CEST | 62852 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:15.153779984 CEST | 62852 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:15.153779984 CEST | 62852 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:15.318141937 CEST | 443 | 62852 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:16.355875015 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:16.468614101 CEST | 443 | 62851 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.013884068 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.014446974 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:17.176186085 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.176758051 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:17.176891088 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:17.176923037 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:17.339755058 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.339837074 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.339857101 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:29:17.340393066 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:17.340459108 CEST | 62853 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:29:27.503730059 CEST | 443 | 62853 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:28.186940908 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:29.818882942 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:29.819459915 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:29.819459915 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:29.981009007 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:29.981609106 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:29.981715918 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:29.981715918 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:29.981767893 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:30.145464897 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:30.146543026 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:30.146755934 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:30.147118092 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Oct 23, 2024 20:30:30.147361994 CEST | 62080 | 443 | 192.168.2.5 | 143.198.137.110 |
Oct 23, 2024 20:30:40.310113907 CEST | 443 | 62080 | 143.198.137.110 | 192.168.2.5 |
Timestamp | Source IP | Dest IP | Checksum | Code | Type |
---|---|---|---|---|---|
Oct 23, 2024 20:29:13.534353018 CEST | 192.168.2.5 | 143.198.137.110 | d9e8 | (Port unreachable) | Destination Unreachable |
Oct 23, 2024 20:29:14.514904022 CEST | 192.168.2.5 | 143.198.137.110 | d9e8 | (Port unreachable) | Destination Unreachable |
Oct 23, 2024 20:29:16.468708992 CEST | 192.168.2.5 | 143.198.137.110 | d9e8 | (Port unreachable) | Destination Unreachable |
Oct 23, 2024 20:29:27.503855944 CEST | 192.168.2.5 | 143.198.137.110 | d918 | (Port unreachable) | Destination Unreachable |
Oct 23, 2024 20:30:40.310339928 CEST | 192.168.2.5 | 143.198.137.110 | d918 | (Port unreachable) | Destination Unreachable |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Target ID: | 0 |
Start time: | 14:29:10 |
Start date: | 23/10/2024 |
Path: | C:\Users\user\Desktop\yqEiP70L9q.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0xf90000 |
File size: | 19'317'248 bytes |
MD5 hash: | 30871D0E0185FCFFD2D9452FFDD456F6 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | Go lang |
Yara matches: |
|
Reputation: | low |
Has exited: | false |