Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
- TCP Requests
-
-
192.168.56.101:49199 185.156.73.37:33287
-
192.168.56.101:49200 185.156.73.37:33287
-
192.168.56.101:49202 185.156.73.37:33287
-
185.156.73.37:33287 192.168.56.101:49203
-
192.168.56.101:49205 185.156.73.37:33287
-
192.168.56.101:49206 185.156.73.37:33287
-
192.168.56.101:49207 185.156.73.37:33287
-
185.156.73.37:33287 192.168.56.101:49208
-
- UDP Requests
-
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
192.168.56.101:62331 239.255.255.250:3702
-
192.168.56.101:62333 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
No traffic
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 185.156.73.37:33287 -> 192.168.56.101:49199 | 2402000 | ET DROP Dshield Block Listed Source group 1 | Misc Attack |
| TCP 192.168.56.101:49199 -> 185.156.73.37:33287 | 2028401 | ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex | Unknown Traffic |
| TCP 192.168.56.101:49205 -> 185.156.73.37:33287 | 2028401 | ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex | Unknown Traffic |
| TCP 192.168.56.101:49206 -> 185.156.73.37:33287 | 2028401 | ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex | Unknown Traffic |
| TCP 192.168.56.101:49200 -> 185.156.73.37:33287 | 2028401 | ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex | Unknown Traffic |
| TCP 185.156.73.37:33287 -> 192.168.56.101:49208 | 2260001 | SURICATA Applayer Wrong direction first Data | Generic Protocol Command Decode |
| TCP 185.156.73.37:33287 -> 192.168.56.101:49203 | 2260001 | SURICATA Applayer Wrong direction first Data | Generic Protocol Command Decode |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts