Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560855
MD5:	feeffe6b4ec91b7313a0f0c3a2bc9850
SHA1:	420d2d6af474adfa2914c976dfa2b98f298276a0
SHA256:	4acc559876c3fad0f837761f3eaad7fcaa080e06f0d9d50f185e0d8e575fc238
Tags:	exeuser-Bitsight
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6152 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FEEFFE6B4EC91B7313A0F0C3A2BC9850)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["87.120.113.179"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
file.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x847e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x851b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8630:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8010:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x827e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x831b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8430:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7e10:$cnc4: POST / HTTP/1.1
00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: file.exe PID: 6152	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.b20000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.file.exe.b20000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x847e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x851b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8630:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8010:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T12:33:15.674703+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:27.645972+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:29.115942+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:39.651988+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:51.623575+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:59.115030+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:03.598581+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.501762+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.680835+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.834018+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:22.739502+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:22.950862+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.131947+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.943680+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:33.300453+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:33.510741+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:45.333915+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:47.749384+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:48.742121+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:48.896890+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:49.265779+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:58.092567+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.142680+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.352735+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.563160+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:11.131644+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:14.834281+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:26.815004+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:29.136466+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:37.806556+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:39.269786+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:42.458577+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:46.678354+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:56.920364+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:59.142873+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:02.521763+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:07.128053+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:12.972271+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:14.472365+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:16.930666+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.183752+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.346071+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.393972+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.471979+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.724574+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.856214+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:22.835403+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:22.990227+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:23.088701+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:24.058913+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:29.123431+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:33.120973+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:36.461577+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:37.776909+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:47.342373+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:58.800491+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:59.010892+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:59.134371+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:37:04.583462+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:37:06.438446+0100	2852870	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T12:33:15.962727+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:27.647632+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:39.653644+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:51.625515+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:03.600788+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.503827+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.682700+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.835535+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:22.743840+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:22.952510+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:29.947527+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:33.302531+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:33.513443+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:45.341409+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:47.756680+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:48.808587+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:48.933015+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:49.299827+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:58.094570+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:59.361099+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:59.571690+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:11.133921+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:14.838218+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:26.818408+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:37.808756+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:39.276841+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:42.461339+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:46.680338+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:56.922209+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:02.547597+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:07.129886+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:12.974090+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:14.474747+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.005716+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.398474+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.433566+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.525919+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.769733+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.890311+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:23.019721+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:23.112644+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:24.063178+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:33.123159+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:36.464576+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:37.779737+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:47.347511+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:58.802343+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:59.012621+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:37:04.587492+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:37:06.443626+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T12:33:29.115942+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:59.115030+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.131947+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.142680+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:29.136466+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:59.142873+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:29.123431+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:59.134371+0100	2852874	1	Malware Command and Control Activity Detected	87.120.113.179	7000	192.168.2.5	49704	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T12:36:14.057662+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.5	49704	87.120.113.179	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe

Malware Configuration Extractor: Xworm {"C2 url": ["87.120.113.179"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: file.exe	String decryptor: 87.120.113.179
Source: file.exe	String decryptor: 7000
Source: file.exe	String decryptor: <123456789>
Source: file.exe	String decryptor: <Xwormmm>
Source: file.exe	String decryptor: XWorm V5.6
Source: file.exe	String decryptor: USB.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49704 -> 87.120.113.179:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 87.120.113.179:7000 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.5:49704 -> 87.120.113.179:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 87.120.113.179:7000 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.5:49704 -> 87.120.113.179:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.113.179

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 87.120.113.179:7000

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.179

Source: file.exe, 00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: file.exe, XLogger.cs

.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\file.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.file.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF848E58A02	0_2_00007FF848E58A02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF848E5B759	0_2_00007FF848E5B759
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF848E57C56	0_2_00007FF848E57C56

Source: file.exe, 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.file.exe.b20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\cga3LG3MEu39iwYg

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: file.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: file.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: file.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: file.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF848E53EAF pushad ; iretd

0_2_00007FF848E53EBD

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1150000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1AFE0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1355			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 8494			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6648

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.4524539432.000000001C080000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.4524539432.000000001C080000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6152, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6152, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	221 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	232 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	232 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	76%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
file.exe	100%	Avira	TR/Spy.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
87.120.113.179	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
87.120.113.179	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.113.179	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560855
Start date and time:	2024-11-22 12:32:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:33:01	API Interceptor	14376521x Sleep call for process: file.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	file.exe	Get hash	malicious	XWorm	Browse	87.120.112.33
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	87.120.115.30
	G0822412237079O_Details_recal_pdf.js	Get hash	malicious	WSHRAT	Browse	87.120.115.30
	Listing_error_15_code_file-002.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	87.120.115.30
	NeftPaymentError_details__Emdtd22102024_jpg.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	87.120.115.30
	https://www.plushtoysmfg.com/plush-keychain-factory/	Get hash	malicious	Anonymous Proxy	Browse	87.120.125.158
	FACTURA9876567800.docx.doc	Get hash	malicious	Lokibot	Browse	87.120.113.235
	GT98765678000800.pif.exe	Get hash	malicious	Lokibot	Browse	87.120.113.235
	POIUYTR0987000.bat.exe	Get hash	malicious	Lokibot	Browse	87.120.113.235
	LGFH9876567800T..bat.exe	Get hash	malicious	Lokibot	Browse	87.120.113.235

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.594430231709924
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	file.exe
File size:	39'936 bytes
MD5:	feeffe6b4ec91b7313a0f0c3a2bc9850
SHA1:	420d2d6af474adfa2914c976dfa2b98f298276a0
SHA256:	4acc559876c3fad0f837761f3eaad7fcaa080e06f0d9d50f185e0d8e575fc238
SHA512:	44b66e4e2f345cbdbc963e57d334c45cef86c3875f35462e6eaa58612c5d3cc1e2879b3ce28e77bf91b3e287f30659f47d87e0418d7320cb6f2e7b6a7a2ec22c
SSDEEP:	384:IOJUBMcFRlOttRngu7/GQftLDC08+1uC2DGyg4/ZaVQkpkFMA0iLTuOZwp0U2v9S:dKM46+Qfx+t+VQGygBeF79WuO+htF76
TLSH:	1E036D04BBD04626DEED6FF065B376060730E617DA13EB5E0CE499AA1F676C4CE007A6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)I@g................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40b09e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67404929 [Fri Nov 22 09:04:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb050	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x90a4	0x9200	279ca65b5e321313bcc99d30a9028c89	False	0.497511772260274	data	5.718886558342842	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4d8	0x600	2472af5ddbb53779b7381f16b8b9407b	False	0.3756510416666667	data	3.7216503306685733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	9d09f41aa32f590eec26ba98d8189c55	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x244	data			0.4724137931034483
RT_MANIFEST	0xc2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T12:33:15.250704+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:15.674703+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:15.962727+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:27.645972+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:27.647632+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:29.115942+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:29.115942+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:39.651988+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:39.653644+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:51.623575+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:51.625515+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:33:59.115030+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:33:59.115030+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:03.598581+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:03.600788+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.501762+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.503827+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.680835+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.682700+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:12.834018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:12.835535+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:22.739502+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:22.743840+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:22.950862+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:22.952510+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:29.131947+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.131947+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.943680+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:29.947527+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:33.300453+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:33.302531+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:33.510741+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:33.513443+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:45.333915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:45.341409+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:47.749384+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:47.756680+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:48.742121+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:48.808587+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:48.896890+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:48.933015+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:49.265779+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:49.299827+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:58.092567+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:58.094570+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:59.142680+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.142680+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.352735+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.361099+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:34:59.563160+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:34:59.571690+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:11.131644+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:11.133921+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:14.834281+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:14.838218+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:26.815004+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:26.818408+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:29.136466+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:29.136466+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:37.806556+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:37.808756+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:39.269786+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:39.276841+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:42.458577+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:42.461339+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:46.678354+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:46.680338+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:56.920364+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:56.922209+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:35:59.142873+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:35:59.142873+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:02.521763+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:02.547597+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:07.128053+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:07.129886+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:12.972271+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:12.974090+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:14.057662+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:14.472365+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:14.474747+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:16.930666+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.005716+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.183752+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.346071+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.393972+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.398474+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.433566+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.471979+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.525919+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.724574+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.769733+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:17.856214+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:17.890311+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:22.835403+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:22.990227+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:23.019721+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:23.088701+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:23.112644+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:24.058913+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:24.063178+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:29.123431+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:29.123431+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:33.120973+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:33.123159+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:36.461577+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:36.464576+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:37.776909+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:37.779737+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:47.342373+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:47.347511+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:58.800491+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:58.802343+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:59.010892+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:59.012621+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:36:59.134371+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:36:59.134371+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:37:04.583462+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:37:04.587492+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP
2024-11-22T12:37:06.438446+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.113.179	7000	192.168.2.5	49704	TCP
2024-11-22T12:37:06.443626+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.5	49704	87.120.113.179	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 12:33:02.992336988 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:03.117815018 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:03.117908955 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:03.272006035 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:03.393074989 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:15.250704050 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:15.370450020 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:15.674702883 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:15.729531050 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:15.962727070 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:16.082664013 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:27.229793072 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:27.350090981 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:27.645972013 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:27.647631884 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:27.767188072 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:29.115942001 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:29.166896105 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:39.214325905 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:39.334003925 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:39.651988029 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:39.653644085 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:39.795711040 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:51.198477030 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:51.318198919 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:51.623574972 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:51.625514984 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:33:51.746336937 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:59.115030050 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:33:59.166925907 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:03.183235884 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:03.303046942 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:03.598581076 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:03.600788116 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:03.720510960 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.058073997 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.178009033 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.229758978 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.350509882 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.350603104 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.470135927 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.501761913 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.503827095 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.666243076 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.680835009 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.682699919 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.802515984 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.834017992 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:12.835535049 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:12.998291969 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.323894978 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:22.444529057 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.444601059 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:22.564971924 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.739501953 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.743839979 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:22.863580942 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.950861931 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:22.952510118 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:23.075932980 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:29.131947041 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:29.260766029 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:29.526577950 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:29.646626949 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:29.943680048 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:29.947526932 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:30.069713116 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:32.886286974 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:33.005985975 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:33.006037951 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:33.126070976 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:33.300452948 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:33.302531004 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:33.422194004 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:33.510740995 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:33.513442993 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:33.633125067 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:44.901576042 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:45.021228075 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:45.333914995 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:45.341408968 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:45.461241961 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:47.325678110 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:47.445509911 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:47.749383926 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:47.756680012 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:47.876281023 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.323617935 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:48.443382978 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.443453074 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:48.564460039 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.564536095 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:48.684740067 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.684850931 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:48.742120981 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.808515072 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.808587074 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:48.896889925 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.932960987 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:48.933015108 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:49.017694950 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.054949045 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.055013895 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:49.104998112 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.174624920 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.179678917 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:49.265779018 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.299747944 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:49.299827099 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:49.419821024 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:57.667279005 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:57.786977053 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:58.092566967 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:58.094569921 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:58.214148045 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:58.698544025 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:58.818569899 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:58.818648100 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:58.938216925 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:59.142679930 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:59.263684988 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:59.352735043 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:59.361099005 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:59.480807066 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:59.563159943 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:34:59.571690083 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:34:59.691344976 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:10.714251041 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:10.833951950 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:11.131644011 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:11.133920908 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:11.256102085 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:14.417463064 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:14.537041903 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:14.834280968 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:14.838217974 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:14.960227966 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:26.401580095 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:26.521194935 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:26.815004110 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:26.818408012 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:26.939564943 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:29.136466026 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:29.260889053 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:37.385934114 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:37.505574942 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:37.806555986 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:37.808756113 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:37.929543972 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:38.854779005 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:38.974473000 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:39.269785881 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:39.276840925 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:39.398228884 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:42.042227983 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:42.162014961 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:42.458576918 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:42.461338997 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:42.581012964 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:46.261019945 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:46.380882025 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:46.678354025 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:46.680337906 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:46.799860001 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:56.495279074 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:56.614955902 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:56.920363903 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:56.922209024 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:35:57.042963028 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:59.142873049 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:35:59.198091030 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:02.105557919 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:02.225253105 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:02.521763086 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:02.547596931 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:02.667983055 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:06.713969946 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:06.833457947 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:07.128052950 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:07.129885912 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:07.249425888 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:12.557802916 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:12.677750111 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:12.972270966 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:12.974090099 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:13.093736887 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:14.057662010 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:14.177434921 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:14.472364902 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:14.474746943 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:14.596121073 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:16.510912895 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:16.631334066 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:16.760948896 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:16.884500980 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:16.884567976 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:16.930665970 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:16.930752039 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.005644083 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.005716085 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.050956011 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.051029921 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.125282049 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.125343084 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.173283100 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.183752060 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.229298115 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.298212051 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.306289911 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.346071005 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.393971920 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.398473978 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.425923109 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.433566093 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.471978903 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.518096924 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.525918961 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.553263903 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.604196072 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.645729065 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.645875931 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.724574089 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.766638994 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.769732952 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:17.856214046 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.889369965 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:17.890311003 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:18.009962082 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.417130947 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.540326118 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.540390015 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.659950018 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.660057068 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.779881001 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.779934883 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.835402966 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.885539055 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.899545908 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.899616003 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:22.990226984 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:22.990310907 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.019648075 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.019721031 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.088701010 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.112449884 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.112643957 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.140471935 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.200591087 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.232234955 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.232311964 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.322935104 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.351905107 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.352021933 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.442662001 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.442840099 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.471844912 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.472987890 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.562320948 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.563664913 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.592777967 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.592864990 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:23.683837891 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:23.712706089 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:24.058912992 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:24.063178062 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:24.184242964 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:29.123430967 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:29.166768074 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:32.698342085 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:32.817945957 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:33.120973110 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:33.123158932 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:33.242928028 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:36.042059898 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:36.163717985 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:36.461576939 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:36.464576006 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:36.587996960 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:37.341582060 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:37.461184978 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:37.776909113 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:37.779736996 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:37.899437904 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:46.901628971 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:47.021306992 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:47.342372894 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:47.347511053 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:47.467145920 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:58.385704041 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:58.505414963 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:58.526309013 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:58.645885944 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:58.800491095 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:58.802342892 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:58.923651934 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:59.010891914 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:59.012620926 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:36:59.134371042 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:59.135068893 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:36:59.182307959 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:37:04.151257038 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:37:04.273220062 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:37:04.583462000 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:37:04.587491989 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:37:04.707489014 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:37:06.021931887 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:37:06.141961098 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:37:06.438446045 CET	7000	49704	87.120.113.179	192.168.2.5
Nov 22, 2024 12:37:06.443625927 CET	49704	7000	192.168.2.5	87.120.113.179
Nov 22, 2024 12:37:06.563788891 CET	7000	49704	87.120.113.179	192.168.2.5

Target ID:	0
Start time:	06:32:58
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb20000
File size:	39'936 bytes
MD5 hash:	FEEFFE6B4EC91B7313A0F0C3A2BC9850
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2060067922.0000000000B22000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.4523082843.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E5B759 Relevance: 2.2, Strings: 1, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hO_H, xrefs: 00007FF848E5BC70

Memory Dump Source

Source File: 00000000.00000002.4525150272.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_file.jbxd

Similarity

API ID:
String ID: hO_H
API String ID: 0-3778298420
Opcode ID: 0545dc4986929a2bc183d35d0d2ceaedfe5f7b420e11abff214004c418b18318
Instruction ID: 03620f8657dfd0fb9d7972c48396bfd11808b17cb05f1d049ef11d2e61bd49ce
Opcode Fuzzy Hash: 0545dc4986929a2bc183d35d0d2ceaedfe5f7b420e11abff214004c418b18318
Instruction Fuzzy Hash: 97628C70E1D91A9FEB94FBB88495AB9B2D2FF98380F555578D01DC3286DF38E8028744

Function 00007FF848E57C56 Relevance: .5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4525150272.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6ba675034a95cbe99aa57a8f9335c7804e376269cb873def79cdf2fcbb74d6
Instruction ID: ebb49cc79118d056f24a1130e8d6bf9ae5023442217973dbda80ead2c04f88c9
Opcode Fuzzy Hash: bb6ba675034a95cbe99aa57a8f9335c7804e376269cb873def79cdf2fcbb74d6
Instruction Fuzzy Hash: A2F1A07090CA8D8FEBA8EF28CC557E977D1FF55350F04426AE84DC7295CB34A9418B86

Function 00007FF848E58A02 Relevance: .5, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4525150272.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3a54a3de6680ee3495fd7ff8c674ade63014f7b345923fb12a57c5099996c4
Instruction ID: c1600231f7819a6f8f984b43ae202c7076c5beb9e11c1d87f04d33edf7628e8c
Opcode Fuzzy Hash: 9b3a54a3de6680ee3495fd7ff8c674ade63014f7b345923fb12a57c5099996c4
Instruction Fuzzy Hash: 85E1C17090CA8E8FEBA8EF28C8567E977E1FB54350F04466ED84DC7295DB3498418B82

Function 00007FF848E51DC8 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF848E51E91

Memory Dump Source

Source File: 00000000.00000002.4525150272.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_file.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5b43a9370b96d2928c6f94a2c48ca64bc3f7899a18d447d9d2695afd91e46d4d
Instruction ID: 755bc57f6a6c5d11e588d80cd1fb648e2f5937b50da13eec786f548ecd6ad8e7
Opcode Fuzzy Hash: 5b43a9370b96d2928c6f94a2c48ca64bc3f7899a18d447d9d2695afd91e46d4d
Instruction Fuzzy Hash: A541F63190CA4D4FDB58EB6C98466F9BBE1FB59311F04027EE049C3292DF75A85287C1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
file.exe

Function 00007FF848E5B759 Relevance: 2.2, Strings: 1, Instructions: 980
COMMON

Function 00007FF848E57C56 Relevance: .5, Instructions: 474
COMMON

Function 00007FF848E58A02 Relevance: .5, Instructions: 460
COMMON

Function 00007FF848E51DC8 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON