Edit tour

Windows Analysis Report
rrwzOU7A9F.exe

Overview

General Information

Sample name:	rrwzOU7A9F.exe renamed because original name is a hash value
Original sample name:	e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe.exe
Analysis ID:	1542726
MD5:	1c60fa81854080166d34761610f776cc
SHA1:	6ee883a9c2ad2c2da0521ace128e30d5134a5ccf
SHA256:	e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe
Tags:	AsyncRATCloudflareTunnelsRATexeuser-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses dynamic DNS services

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

rrwzOU7A9F.exe (PID: 1708 cmdline: "C:\Users\user\Desktop\rrwzOU7A9F.exe" MD5: 1C60FA81854080166D34761610F776CC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["dcxwq1.duckdns.org"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
rrwzOU7A9F.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
rrwzOU7A9F.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a50:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7aed:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7c02:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76fe:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7850:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x78ed:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7a02:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x74fe:$cnc4: POST / HTTP/1.1
00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: rrwzOU7A9F.exe PID: 1708	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.rrwzOU7A9F.exe.540000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.rrwzOU7A9F.exe.540000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a50:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7aed:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7c02:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76fe:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T08:49:35.419392+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:41.913399+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:48.943686+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:02.507233+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:11.936044+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:16.186931+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:21.663370+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.643734+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.708962+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.724257+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.760886+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.823417+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.841502+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:24.673456+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:29.882203+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:29.927070+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:29.999470+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:35.314748+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.147022+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.193674+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.210046+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.240263+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.264428+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.357514+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:41.913604+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:45.772265+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:45.890487+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.006032+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.007583+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.115128+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.185135+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:53.744836+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.365831+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.483152+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.552913+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.600053+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:01.866080+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:02.023642+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:05.850745+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:11.907963+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.438555+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.552637+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.555640+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.669729+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.178130+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.318229+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.333754+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.349617+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.398627+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.424059+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.541557+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.578782+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.722490+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.795827+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:23.272052+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:24.179811+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:24.296951+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:31.254259+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.070884+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.130819+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.177413+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.187766+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.288334+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.908409+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:40.726339+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:41.905649+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:42.631406+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.271948+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.349235+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.389349+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.490877+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.519413+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:58.050087+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.653382+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.789879+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.928012+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:08.437102+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:11.907273+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:16.579945+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:19.690980+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:22.892306+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:23.631479+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:27.890630+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:34.036603+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:36.903619+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:37.161558+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:40.047891+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:40.266527+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:41.909233+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:42.026520+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:44.956710+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:46.317729+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:55.219164+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:56.631341+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.793617+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.900960+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.909673+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:09.892693+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:11.888063+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.118199+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.235242+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.258738+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.271759+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.366277+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:19.085391+0200	2852870	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T08:49:35.740810+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:49:48.946134+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:02.510379+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:16.189519+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:21.666777+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.645831+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.717868+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.725946+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.763107+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.826239+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.843343+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:24.676650+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.893965+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.929520+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.995334+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:30.001534+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:30.007113+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:35.319251+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.150407+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.202355+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.212266+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.243945+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.267289+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.359998+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:45.774859+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:45.893288+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.008732+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.014901+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.117437+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.187119+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.345745+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.351373+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:53.747346+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.373310+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.485784+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.557951+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.606347+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:01.900892+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:02.284542+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:05.852920+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.445452+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.531155+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.537086+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.672090+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.180682+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.320532+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.335478+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.351831+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.400583+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.552350+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.591309+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.735291+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.803011+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:23.274619+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.181993+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.273174+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.298889+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:31.263142+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.073347+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.132985+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.179546+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.189678+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.290692+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.916093+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:40.728473+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:42.636188+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.273830+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.351150+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.391215+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.493810+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.524129+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:58.053146+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.656063+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.676067+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.739089+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.773767+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.845664+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.892122+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.985594+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:08.438793+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:16.581971+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:19.693608+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:22.895827+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:23.633635+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:27.893059+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:34.038374+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:36.907108+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:37.164934+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:40.048997+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:40.267551+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:42.027822+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:44.957638+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:46.318675+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:55.223462+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:56.632285+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.794925+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.906271+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.918450+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:09.893663+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.118987+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.236141+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.272556+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.325547+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.366946+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:19.086163+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T08:49:41.913399+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:11.936044+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:41.913604+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:11.907963+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:41.905649+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:11.907273+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:41.909233+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:11.888063+0200	2852874	1	Malware Command and Control Activity Detected	101.99.92.203	7000	192.168.2.6	49711	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T08:50:29.668465+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.6	49711	101.99.92.203	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rrwzOU7A9F.exe

Avira: detected

Found malware configuration

Source: rrwzOU7A9F.exe

Malware Configuration Extractor: Xworm {"C2 url": ["dcxwq1.duckdns.org"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}

Multi AV Scanner detection for submitted file

Source: rrwzOU7A9F.exe	ReversingLabs: Detection: 78%
Source: rrwzOU7A9F.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: rrwzOU7A9F.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: rrwzOU7A9F.exe	String decryptor: dcxwq1.duckdns.org
Source: rrwzOU7A9F.exe	String decryptor: 7000
Source: rrwzOU7A9F.exe	String decryptor: <123456789>
Source: rrwzOU7A9F.exe	String decryptor: <Xwormmm>
Source: rrwzOU7A9F.exe	String decryptor: XWorm V5.2
Source: rrwzOU7A9F.exe	String decryptor: USB.exe

Source: rrwzOU7A9F.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: rrwzOU7A9F.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49711 -> 101.99.92.203:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 101.99.92.203:7000 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49711 -> 101.99.92.203:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 101.99.92.203:7000 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49711 -> 101.99.92.203:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: dcxwq1.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: dcxwq1.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 101.99.92.203:7000

Source: Joe Sandbox View

IP Address: 101.99.92.203 101.99.92.203

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: dcxwq1.duckdns.org

Source: rrwzOU7A9F.exe, 00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: rrwzOU7A9F.exe, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: rrwzOU7A9F.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.rrwzOU7A9F.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD34657692	0_2_00007FFD34657692
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD346568E6	0_2_00007FFD346568E6
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD34652850	0_2_00007FFD34652850
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD346529FA	0_2_00007FFD346529FA

Source: rrwzOU7A9F.exe, 00000000.00000000.2129762826.000000000054C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamea.exe4 vs rrwzOU7A9F.exe
Source: rrwzOU7A9F.exe	Binary or memory string: OriginalFilenamea.exe4 vs rrwzOU7A9F.exe

Source: rrwzOU7A9F.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: rrwzOU7A9F.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.rrwzOU7A9F.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: rrwzOU7A9F.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rrwzOU7A9F.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rrwzOU7A9F.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/1

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Mutant created: \Sessions\1\BaseNamedObjects\KuxjcUwK7YR0UBzc

Source: rrwzOU7A9F.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rrwzOU7A9F.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rrwzOU7A9F.exe	ReversingLabs: Detection: 78%
Source: rrwzOU7A9F.exe	Virustotal: Detection: 79%

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: rrwzOU7A9F.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rrwzOU7A9F.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: rrwzOU7A9F.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD346500BD pushad ; iretd		0_2_00007FFD346500C1
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Code function: 0_2_00007FFD34651574 push E95EE936h; ret		0_2_00007FFD34651599

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Memory allocated: A70000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	Memory allocated: 1A910000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Window / User API: threadDelayed 9663

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe TID: 6880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe TID: 6876	Thread sleep count: 9663 > 30	Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe TID: 6876	Thread sleep count: 175 > 30	Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\rrwzOU7A9F.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: rrwzOU7A9F.exe, 00000000.00000002.4578889465.000000001B870000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllniti6

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Queries volume information: C:\Users\user\Desktop\rrwzOU7A9F.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\rrwzOU7A9F.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: rrwzOU7A9F.exe, type: SAMPLE
Source: Yara match	File source: 0.0.rrwzOU7A9F.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rrwzOU7A9F.exe PID: 1708, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: rrwzOU7A9F.exe, type: SAMPLE
Source: Yara match	File source: 0.0.rrwzOU7A9F.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rrwzOU7A9F.exe PID: 1708, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	111 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	131 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rrwzOU7A9F.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
rrwzOU7A9F.exe	79%	Virustotal		Browse
rrwzOU7A9F.exe	100%	Avira	TR/Spy.Gen
rrwzOU7A9F.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dcxwq1.duckdns.org	101.99.92.203	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dcxwq1.duckdns.org	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rrwzOU7A9F.exe, 00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
101.99.92.203	dcxwq1.duckdns.org	Malaysia		45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542726
Start date and time:	2024-10-26 08:48:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rrwzOU7A9F.exe renamed because original name is a hash value
Original Sample Name:	e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Simulations

Behavior and APIs

Time	Type	Description
02:49:15	API Interceptor	13858497x Sleep call for process: rrwzOU7A9F.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
101.99.92.203	3xlcP3DFLm.exe	Get hash	malicious	XWorm	Browse
	JruZmEO5Dm.exe	Get hash	malicious	XWorm	Browse
	zVlbADkNqu.exe	Get hash	malicious	XWorm	Browse
	vqUuq8t2Uc.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	pXJ9iQvcQa.exe	Get hash	malicious	AsyncRAT, DcRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dcxwq1.duckdns.org	3xlcP3DFLm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	JruZmEO5Dm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	zVlbADkNqu.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	vqUuq8t2Uc.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	101.99.92.203
	pXJ9iQvcQa.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	101.99.92.203
	a.cmd	Get hash	malicious	Unknown	Browse	91.92.249.117

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	3xlcP3DFLm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	JruZmEO5Dm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	zVlbADkNqu.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	vqUuq8t2Uc.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	101.99.92.203
	pXJ9iQvcQa.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	101.99.92.203
	https://app.adjust.com/mr11ui?fallback=https://abcshopbd.com/#amVmZi5kaXhvbiRhdXN0YWx1c2EuY29t	Get hash	malicious	HTMLPhisher	Browse	111.90.141.53
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	101.99.94.195
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	101.99.94.195
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	101.99.94.195
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	101.99.94.195

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.6312729673583037
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	rrwzOU7A9F.exe
File size:	65'536 bytes
MD5:	1c60fa81854080166d34761610f776cc
SHA1:	6ee883a9c2ad2c2da0521ace128e30d5134a5ccf
SHA256:	e28df9b4fe8cf6c4f407f1536ee07b6b641f7d4641723a0d7a05796c236babfe
SHA512:	e3cd8b5bb34dbba8995d39de34e2d541804c29ab930bfa365c803a00fa1e0f6738ba2afb42d740a180c7201f6599e1a26f82a38970247ac4c22728ace06d0040
SSDEEP:	768:9GLtt3QI2/yQJVZsXeo8icHS1WbFb9YGQOMhwQnvO:9Ab3QI2/yQBKeNicHS1SFb9YGQOM6aO
TLSH:	23534C48BB944216D9ED6FF469B372020674D713D917EB4E48E48ADB6F23BC48D013EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... !f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40a5fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6621200D [Thu Apr 18 13:28:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa5b0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8604	0x8800	49a5e522ae8e037e2409f27e37a5f58c	False	0.4927332261029412	data	5.691481388961481	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4c0	0x600	30c5eb268fae0bb062894b64cd0262f3	False	0.37109375	data	3.6729732155924846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	1f3bc23101ffde98df7e0ea47b99e2c8	False	0.041015625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x22c	data			0.4712230215827338
RT_MANIFEST	0xc2d0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T08:49:35.174984+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:49:35.419392+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:35.740810+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:49:41.913399+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:41.913399+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:48.943686+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:49:48.946134+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:02.507233+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:02.510379+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:11.936044+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:11.936044+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:16.186931+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:16.189519+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:21.663370+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:21.666777+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.643734+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.645831+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.708962+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.717868+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.724257+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.725946+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.760886+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.763107+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.823417+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.826239+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:23.841502+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:23.843343+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:24.673456+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:24.676650+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.668465+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.882203+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:29.893965+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.927070+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:29.929520+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.995334+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:29.999470+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:30.001534+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:30.007113+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:35.314748+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:35.319251+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.147022+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.150407+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.193674+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.202355+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.210046+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.212266+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.240263+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.243945+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.264428+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.267289+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:40.357514+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:40.359998+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:41.913604+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:41.913604+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:45.772265+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:45.774859+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:45.890487+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:45.893288+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.006032+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.007583+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.008732+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.014901+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.115128+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.117437+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.185135+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:46.187119+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.345745+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:46.351373+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:53.744836+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:53.747346+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.365831+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.373310+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.483152+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.485784+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.552913+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.557951+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:50:56.600053+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:50:56.606347+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:01.866080+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:01.900892+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:02.023642+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:02.284542+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:05.850745+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:05.852920+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:11.907963+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:11.907963+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.438555+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.445452+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.531155+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.537086+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:12.552637+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.555640+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.669729+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:12.672090+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.178130+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.180682+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.318229+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.320532+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.333754+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.335478+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.349617+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.351831+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.398627+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.400583+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.424059+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.541557+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.552350+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.578782+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.591309+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.722490+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.735291+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:18.795827+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:18.803011+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:23.272052+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:23.274619+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.179811+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:24.181993+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.273174+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:24.296951+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:24.298889+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:31.254259+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:31.263142+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.070884+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.073347+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.130819+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.132985+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.177413+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.179546+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.187766+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.189678+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.288334+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.290692+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:34.908409+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:34.916093+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:40.726339+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:40.728473+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:41.905649+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:41.905649+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:42.631406+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:42.636188+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.271948+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.273830+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.349235+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.351150+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.389349+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.391215+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.490877+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.493810+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:44.519413+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:44.524129+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:51:58.050087+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:51:58.053146+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.653382+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.656063+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.676067+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.739089+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.773767+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.789879+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.845664+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.892122+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:00.928012+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:00.985594+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:08.437102+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:08.438793+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:11.907273+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:11.907273+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:16.579945+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:16.581971+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:19.690980+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:19.693608+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:22.892306+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:22.895827+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:23.631479+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:23.633635+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:27.890630+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:27.893059+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:34.036603+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:34.038374+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:36.903619+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:36.907108+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:37.161558+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:37.164934+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:40.047891+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:40.048997+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:40.266527+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:40.267551+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:41.909233+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:41.909233+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:42.026520+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:42.027822+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:44.956710+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:44.957638+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:46.317729+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:46.318675+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:55.219164+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:55.223462+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:52:56.631341+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:52:56.632285+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.793617+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.794925+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.900960+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.906271+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:06.909673+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:06.918450+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:09.892693+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:09.893663+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:11.888063+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:11.888063+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.118199+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.118987+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.235242+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.236141+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.258738+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.271759+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.272556+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.325547+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:12.366277+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:12.366946+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP
2024-10-26T08:53:19.085391+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	101.99.92.203	7000	192.168.2.6	49711	TCP
2024-10-26T08:53:19.086163+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.6	49711	101.99.92.203	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 08:49:21.414048910 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:21.419796944 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:21.419898987 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:21.626631021 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:21.632040977 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:35.174983978 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:35.180305958 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:35.419392109 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:35.464574099 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:35.740809917 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:35.746042013 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:41.913398981 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:41.964636087 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:48.699361086 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:48.704744101 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:48.943686008 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:49:48.946134090 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:49:48.951586008 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:02.246539116 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:02.252126932 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:02.507232904 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:02.510379076 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:02.515748978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:11.936043978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:11.980263948 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:15.777503014 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:15.782901049 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:16.186930895 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:16.189518929 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:16.194902897 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:21.418334007 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:21.424072981 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:21.663369894 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:21.666776896 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:21.672202110 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.387223959 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.392728090 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.433893919 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.439280033 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.465095997 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.470562935 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.480778933 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.486186028 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.527504921 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.532939911 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.574419975 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.579814911 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.643733978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.645831108 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.651173115 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.708961964 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.717868090 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.723409891 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.724256992 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.725945950 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.760885954 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.763107061 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.809606075 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.823416948 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.826239109 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.831693888 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.841501951 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:23.843343019 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:23.889539957 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:24.420037031 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:24.425638914 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:24.673455954 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:24.676650047 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:24.682041883 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.636954069 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.643100023 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.668464899 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.673996925 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.683603048 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.689075947 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.699354887 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.704858065 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.746130943 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.752491951 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.882203102 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.893965006 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.899295092 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.927069902 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.929519892 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.977572918 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.990667105 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:29.995333910 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:29.999469995 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:30.001482964 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:30.001533985 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:30.007065058 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:30.007112980 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:30.012520075 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:35.059940100 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:35.067348003 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:35.314748049 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:35.319251060 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:35.324750900 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:39.902744055 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:39.908407927 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:39.933954954 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:39.939486027 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:39.949647903 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:39.955393076 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:39.965147018 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:39.970766068 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:39.996510983 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.002479076 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.074573040 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.080054045 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.147022009 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.150407076 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.157115936 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.193674088 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.202354908 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.210046053 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.212265968 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.240262985 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.243944883 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.264427900 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.267288923 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.313572884 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.357513905 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:40.359997988 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:40.367350101 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:41.913604021 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:41.964644909 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.527914047 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.533417940 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.636954069 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.642479897 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.730762005 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.736223936 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.762196064 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.767739058 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.772264957 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.774858952 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.821508884 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.855811119 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.861381054 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.871504068 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.876935005 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.890486956 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.893287897 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.941591978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:45.941664934 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:45.947011948 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.006031990 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.007582903 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.007638931 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.008732080 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.014841080 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.014900923 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.020958900 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.115128040 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.117436886 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.123272896 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.185134888 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.187119007 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.192728043 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.343449116 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.345745087 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.351284981 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:46.351372957 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:46.356873035 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:53.496298075 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:53.502012968 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:53.744836092 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:53.747345924 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:53.752897978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.121287107 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.126960993 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.230842113 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.236653090 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.293493986 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.299097061 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.308706045 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.314135075 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.365830898 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.373310089 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.378734112 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.483151913 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.485784054 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.492661953 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.552912951 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.557950974 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.563487053 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.600053072 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:50:56.606347084 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:50:56.657594919 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:01.621592045 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:01.628223896 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:01.668395042 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:01.674890995 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:01.866080046 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:01.900892019 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:01.906362057 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:02.023642063 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:02.136554956 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:02.284542084 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:02.290093899 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:05.605963945 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:05.611572981 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:05.850744963 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:05.852920055 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:05.858433962 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:11.777544975 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:11.783093929 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:11.886985064 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:11.892904043 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:11.907963037 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:11.933805943 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:11.981564999 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.012259960 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.017842054 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.058876038 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.064254045 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.074351072 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.079710960 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.106561899 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.112034082 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.152539968 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.157834053 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.277770042 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.283201933 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.308787107 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.314234018 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.324493885 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.330040932 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.438555002 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.445451975 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.450915098 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.521821022 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.531155109 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.536879063 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.537086010 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.542720079 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.543014050 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.548470020 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.552282095 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.552637100 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.555639982 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.555813074 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.601471901 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.601773024 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.607203007 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.669728994 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:12.672090054 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:12.677531958 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:17.933950901 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:17.939311028 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:17.982182026 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:17.987478971 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.074631929 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.080040932 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.090293884 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.095670938 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.105922937 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.112190962 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.152631998 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.162139893 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.178129911 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.180681944 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.229533911 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.229638100 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.234987974 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.318228960 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.320532084 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.325789928 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.325915098 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.331171036 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.333754063 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.335478067 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.349617004 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.351830959 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.398627043 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.400583029 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.424058914 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.424154043 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.473468065 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.479024887 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.484394073 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.541557074 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.552350044 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.557765007 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.578782082 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.591309071 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.641443968 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.722490072 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.735291004 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.740772963 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.795826912 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:18.803010941 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:18.808922052 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.027880907 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.033255100 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.272052050 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.274619102 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.280111074 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.683862925 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.689284086 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.699541092 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.704871893 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.714982986 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.720288038 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:23.730767012 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:23.736061096 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.027600050 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:24.032987118 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.179811001 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.181993008 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:24.187347889 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.271083117 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.273174047 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:24.278578997 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.278732061 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:24.284020901 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.296951056 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:24.298888922 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:24.345489979 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:30.966877937 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:30.972162008 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:31.254259109 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:31.263142109 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:31.268500090 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:33.824513912 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:33.829801083 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:33.840017080 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:33.845453024 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:33.887183905 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:33.892563105 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:33.933958054 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:33.939357042 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:33.965198040 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:33.970597982 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.070883989 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.073347092 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.078900099 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.130819082 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.132985115 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.138650894 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.177412987 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.179546118 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.187766075 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.189677954 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.237505913 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.288333893 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.290692091 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.296132088 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.402885914 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.408337116 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.908409119 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:34.916093111 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:34.921596050 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:40.481923103 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:40.487334967 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:40.726339102 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:40.728472948 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:40.734055042 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:41.905648947 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:41.980376959 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:42.386993885 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:42.392529964 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:42.631406069 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:42.636188030 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:42.641621113 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.027923107 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.033351898 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.059149027 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.064563036 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.105807066 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.115382910 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.168426991 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.175065041 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.246560097 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.255583048 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.271948099 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.273829937 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.325475931 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.349235058 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.351150036 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.356472015 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.389348984 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.391215086 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.437577963 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.490876913 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.493809938 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.499181986 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.519412994 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:44.524128914 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:44.573451042 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:57.793416023 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:57.808650017 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:58.050086975 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:58.053145885 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:58.067382097 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:51:59.621608973 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:51:59.933545113 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.415604115 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.415623903 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.415677071 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.433656931 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.653382063 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.656063080 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.669749975 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.672282934 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.676067114 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.737512112 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.739089012 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.751116037 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.771271944 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.773766994 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.789879084 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.789973974 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.845489025 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.845664024 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.864670038 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.888004065 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.892122030 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.906824112 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.907063007 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.928011894 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.928128958 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.985522985 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:00.985594034 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:00.998889923 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:08.184017897 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:08.197582006 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:08.437102079 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:08.438792944 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:08.451066971 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:11.907273054 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:11.949137926 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:16.324707031 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:16.338776112 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:16.579945087 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:16.581970930 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:16.596208096 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:19.436069965 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:19.451900959 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:19.690979958 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:19.693608046 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:19.708805084 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:22.622296095 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:22.637096882 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:22.892306089 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:22.895827055 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:22.908126116 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:23.277915955 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:23.363699913 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:23.631479025 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:23.633635044 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:23.646487951 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:27.637029886 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:27.651946068 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:27.890630007 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:27.893059015 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:27.903703928 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:33.777863026 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:33.783607960 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:34.036602974 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:34.038373947 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:34.044262886 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:36.449595928 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:36.459300995 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:36.833313942 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:36.903619051 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:36.904227018 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:36.907108068 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:36.920861006 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:37.161557913 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:37.164933920 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:37.175704956 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:39.793378115 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:39.808866978 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:40.012016058 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:40.027805090 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:40.047890902 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:40.048996925 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:40.105436087 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:40.266526937 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:40.267550945 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:40.282222986 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:41.762095928 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:41.777899027 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:41.909233093 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:41.964798927 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:42.026520014 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:42.027822018 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:42.042376995 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:44.702163935 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:44.717936039 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:44.956710100 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:44.957638025 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:44.972598076 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:46.058810949 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:46.073524952 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:46.317728996 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:46.318675041 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:46.333420038 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:54.965518951 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:54.978727102 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:55.219163895 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:55.223462105 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:55.237724066 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:56.355854034 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:56.392512083 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:56.631340981 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:52:56.632285118 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:52:56.646161079 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.543247938 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.553133965 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.621408939 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.631371975 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.652548075 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.662971020 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.793617010 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.794924974 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.806504011 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.900959969 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.906270981 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.909672976 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.917391062 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:06.918450117 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:06.929682016 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:09.640140057 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:09.651164055 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:09.892693043 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:09.893662930 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:09.906621933 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:11.871366024 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:11.878129959 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:11.888062954 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:11.933574915 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:11.933931112 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:11.993794918 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:11.996481895 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.004954100 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.012300968 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.020634890 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.027739048 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.033824921 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.118199110 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.118987083 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.128004074 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.235241890 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.236140966 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.241417885 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.258738041 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.271759033 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.271811008 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.272556067 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.325503111 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.325546980 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.330854893 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.366276979 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:12.366945982 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:12.413474083 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:18.840061903 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:18.845473051 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:19.085391045 CEST	7000	49711	101.99.92.203	192.168.2.6
Oct 26, 2024 08:53:19.086163044 CEST	49711	7000	192.168.2.6	101.99.92.203
Oct 26, 2024 08:53:19.091581106 CEST	7000	49711	101.99.92.203	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 08:49:17.387379885 CEST	54916	53	192.168.2.6	1.1.1.1
Oct 26, 2024 08:49:18.386786938 CEST	54916	53	192.168.2.6	1.1.1.1
Oct 26, 2024 08:49:19.402539968 CEST	54916	53	192.168.2.6	1.1.1.1
Oct 26, 2024 08:49:21.398121119 CEST	53	54916	1.1.1.1	192.168.2.6
Oct 26, 2024 08:49:21.398144007 CEST	53	54916	1.1.1.1	192.168.2.6
Oct 26, 2024 08:49:21.398156881 CEST	53	54916	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 08:49:17.387379885 CEST	192.168.2.6	1.1.1.1	0x78be	Standard query (0)	dcxwq1.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 08:49:18.386786938 CEST	192.168.2.6	1.1.1.1	0x78be	Standard query (0)	dcxwq1.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 26, 2024 08:49:19.402539968 CEST	192.168.2.6	1.1.1.1	0x78be	Standard query (0)	dcxwq1.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 08:49:21.398121119 CEST	1.1.1.1	192.168.2.6	0x78be	No error (0)	dcxwq1.duckdns.org	101.99.92.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 08:49:21.398144007 CEST	1.1.1.1	192.168.2.6	0x78be	No error (0)	dcxwq1.duckdns.org	101.99.92.203	A (IP address)	IN (0x0001)	false
Oct 26, 2024 08:49:21.398156881 CEST	1.1.1.1	192.168.2.6	0x78be	No error (0)	dcxwq1.duckdns.org	101.99.92.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:49:12
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\rrwzOU7A9F.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\rrwzOU7A9F.exe"
Imagebase:	0x540000
File size:	65'536 bytes
MD5 hash:	1C60FA81854080166D34761610F776CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2129741848.0000000000542000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4577195379.0000000002911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34652850 Relevance: 2.4, Strings: 1, Instructions: 1142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD3465B1A0

Memory Dump Source

Source File: 00000000.00000002.4579716440.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34650000_rrwzOU7A9F.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a8770be5d95fbb3b6b2d920ce4ea4b6ec9107a102590faa3f98b125127a6dea3
Instruction ID: 4aabdb89600bd533439a9f98782e73ab759dfcd090893d5ed6fa9817dfff3379
Opcode Fuzzy Hash: a8770be5d95fbb3b6b2d920ce4ea4b6ec9107a102590faa3f98b125127a6dea3
Instruction Fuzzy Hash: 10725030B1C92A4FEBA4FB7884A56B973D2EF99310B5445B9D51ED3282DE2CEC42D740

Function 00007FFD346568E6 Relevance: .5, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4579716440.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34650000_rrwzOU7A9F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acd1b2c22911e48fe835795bf68512353ad67386c7761789136c3d7694e378c
Instruction ID: af15d076fa74853c244c663e1b0e8f09d7adc0afbf3c8ef53898b34c0a587396
Opcode Fuzzy Hash: 4acd1b2c22911e48fe835795bf68512353ad67386c7761789136c3d7694e378c
Instruction Fuzzy Hash: 41F19530A08A4D8FEBA8DF28C8557E977E1FF55310F04826EE84DC7291DB78A955CB81

Function 00007FFD34657692 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4579716440.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34650000_rrwzOU7A9F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d657bc33fd0a21bca2c10bce2507c074dfd0704b983dfa3954bb50b03f9c3945
Instruction ID: 3090d9a2e180c68deb2f5f902aa3fdf5336b9f259c216e6cfe760d888a5791fe
Opcode Fuzzy Hash: d657bc33fd0a21bca2c10bce2507c074dfd0704b983dfa3954bb50b03f9c3945
Instruction Fuzzy Hash: C0E1C330A08A4E8FEBA9DF28C8657E977E1FF55311F14426ED84DC7291DF78A8408B81

Function 00007FFD34651BE8 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD34651CB1

Memory Dump Source

Source File: 00000000.00000002.4579716440.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34650000_rrwzOU7A9F.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: dfcacbffd20792bd6fd8effffe022092764e1ecd2aa1b21969b1bcde8a75a465
Instruction ID: a30fd81a90e20d4cea84e42af8b355f87d75bc8f0a936647ad809ea49f55e2a6
Opcode Fuzzy Hash: dfcacbffd20792bd6fd8effffe022092764e1ecd2aa1b21969b1bcde8a75a465
Instruction Fuzzy Hash: A7410A31A1CA5C4FDB19DF6CD8566F97BE1EB5A311F00027ED04DD3192DA65A812C7C1

Non-executed Functions

Function 00007FFD346529FA Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4579716440.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34650000_rrwzOU7A9F.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce9046332db8dd67ffd3fa20269f64c77a5d74a9ff776ad7272901be63e01b5
Instruction ID: 757fd986bd7a344acf6a2064fe725594b67cf14ccd672ec56da53f88e7bf986e
Opcode Fuzzy Hash: 6ce9046332db8dd67ffd3fa20269f64c77a5d74a9ff776ad7272901be63e01b5
Instruction Fuzzy Hash: 1E4104ABA0D6E21EF2638F6D5CF54D63FA8EF5322470910F3D2C5C6093E90D2547AA61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rrwzOU7A9F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
rrwzOU7A9F.exe

Function 00007FFD34652850 Relevance: 2.4, Strings: 1, Instructions: 1142
COMMON

Function 00007FFD346568E6 Relevance: .5, Instructions: 470
COMMON

Function 00007FFD34651BE8 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON