Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | Sept. 4, 2023, 3:02 p.m. | Sept. 4, 2023, 3:05 p.m. |
IP Address | Status | Action |
---|---|---|
104.18.145.235 | Active | Moloch |
104.21.56.98 | Active | Moloch |
104.21.84.222 | Active | Moloch |
104.26.4.15 | Active | Moloch |
104.26.5.15 | Active | Moloch |
104.26.9.59 | Active | Moloch |
121.254.136.9 | Active | Moloch |
148.251.234.83 | Active | Moloch |
148.251.234.93 | Active | Moloch |
149.202.0.242 | Active | Moloch |
162.0.217.254 | Active | Moloch |
163.123.143.4 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.67.75.163 | Active | Moloch |
172.67.75.166 | Active | Moloch |
176.123.9.142 | Active | Moloch |
181.214.31.34 | Active | Moloch |
185.225.73.32 | Active | Moloch |
194.169.175.128 | Active | Moloch |
194.26.135.162 | Active | Moloch |
34.117.59.81 | Active | Moloch |
45.15.156.229 | Active | Moloch |
77.91.68.238 | Active | Moloch |
87.121.221.58 | Active | Moloch |
87.240.129.133 | Active | Moloch |
87.240.132.67 | Active | Moloch |
87.240.137.164 | Active | Moloch |
87.240.190.76 | Active | Moloch |
94.142.138.113 | Active | Moloch |
95.142.206.0 | Active | Moloch |
95.142.206.1 | Active | Moloch |
95.142.206.2 | Active | Moloch |
95.142.206.3 | Active | Moloch |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49175 104.26.9.59:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65 |
TLSv1 192.168.56.102:49183 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49196 104.21.84.222:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=preconcert.pw | 60:b2:a3:3e:2f:80:57:cd:6f:c1:a3:e9:b3:c6:cb:95:41:83:4a:64 |
TLSv1 192.168.56.102:49224 87.240.190.76:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49219 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49228 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49231 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49233 95.142.206.1:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49240 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49241 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49243 95.142.206.2:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49254 95.142.206.3:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49253 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49251 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49252 87.240.137.164:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49236 95.142.206.0:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49260 172.67.75.163:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65 |
TLSv1 192.168.56.102:49270 172.67.75.166:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49271 104.26.5.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49255 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49269 104.26.4.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
suspicious_features | Connection to IP address | suspicious_request | GET http://94.142.138.113/api/tracemap.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://94.142.138.113/api/firegate.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://77.91.68.238/info/fotos894.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://87.121.221.58/g.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://87.121.221.58/g.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://77.91.68.238/info/fotos894.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://45.15.156.229/api/tracemap.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://45.15.156.229/api/firegate.php |
request | GET http://94.142.138.113/api/tracemap.php |
request | POST http://94.142.138.113/api/firegate.php |
request | HEAD http://77.91.68.238/info/fotos894.exe |
request | HEAD http://87.121.221.58/g.exe |
request | HEAD http://myfilebest.com/order/set17.exe |
request | GET http://myfilebest.com/order/set17.exe |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET http://87.121.221.58/g.exe |
request | GET http://77.91.68.238/info/fotos894.exe |
request | GET http://45.15.156.229/api/tracemap.php |
request | POST http://45.15.156.229/api/firegate.php |
request | GET http://www.maxmind.com/geoip/v2.1/city/me |
request | GET https://api.myip.com/ |
request | GET https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1 |
request | GET https://preconcert.pw/setup294.exe |
request | GET https://vk.com/doc44017378_668841700?hash=B7naXG9fPpueUKaZxzbzFzqgThiLopd9A232GVSoLbD&dl=VDCn0RuU4RRcIuzpA6hHZu4JCvVt7UCUAmWFRORbSKs&api=1&no_preview=1 |
request | GET https://psv4.userapi.com/c909618/u44017378/docs/d58/3ae907fdfcf3/Synapse.bmp?extra=KUBnABH___ud3k6Iz_4j06dbnFS9VRlNbUwfTgh7gFkqGiY9bpQRB8S2WTllutClgFicO9HQdM2CdICtoMDrTIUve1tpzFA4EraxxEm1T-w5HYMIufQJZJ3ZZuL60ICYmx_il49EiGSxeEtl |
request | GET https://vk.com/doc44017378_668806860?hash=qtzoSGTGfTX0Y89NBaFBYakjoCyaeVOVJQ5aLZ9qe6c&dl=MsOUl0nIy2MxBmzFM55NV4K7DzBdgHfls4LY6OEHerL&api=1&no_preview=1#qq |
request | GET https://sun6-21.userapi.com/c909218/u44017378/docs/d35/7d15da7ffef6/qq.bmp?extra=2GxVWJpu25oym3VxYwWNtfWO8cQIKYpcF0VxbVK3BFm6aprr9H7tTHFEku9l_-NfQgcfHxfucUok_MgxivF-HiFfE_IhhOE0f3IqvHMsERCQI19xXhu3k8QfnZs_rFCImiUJW5RjB0c29Ysf |
request | GET https://vk.com/doc44017378_668805679?hash=Pq8nRu8IL2bYqDVs2GPjMvpAFMOm04kusdFGQmRlGY0&dl=ns6C3Wug8h8cGKJrvWC9ONCmtSXnbVIqzmpprkB3Voz&api=1&no_preview=1#rise |
request | GET https://sun6-20.userapi.com/c909228/u44017378/docs/d21/84fb03a45baf/RisePro_0_5_eM6kP0V0t0TJM31LPkFZ.bmp?extra=0flX9Y0ztZxXjKMYf4MpJJjzvYpZP31BlbRhAJosHEXpLdo8JT_b5DH9Y0PRC9dGByVJGDom6Q85dl7oudoJZHFhYVAOPLcxqHxV4bfTwq2t2ZLBF5atjVwW-KpohUyr8NnU5FS4_f1sEXD4 |
request | GET https://vk.com/doc44017378_668679037?hash=6lxdrm9NUkSryZCfzYZn4zR2sOTXzaKgfQIcVCaPnvX&dl=FLqYTpktPSSWsXhtSyyzRawRyuZZexn7WIKXiXEZBv4&api=1&no_preview=1 |
request | GET https://sun6-20.userapi.com/c909618/u44017378/docs/d36/970407f834ab/PL_Client.bmp?extra=aN41sDSFUADrGrdU_RjM1QHebyaC6CfPPnkhN8Sh5X1ARi3KwK86JBBO2RmrPchH2zWsjNJamP2kvNM4ZBw3wVvUHefjC0u7DuaIJJ3n0zlEfuc5TbQudsfFWKgLDw8h18lU6pjBLjcaodL_ |
request | GET https://vk.com/doc44017378_668771908?hash=xTpUd6Irq53Iv3XxYBTLtZCTvA1vPIxYTBJi9GFflYg&dl=r01wYZoWFOYu6Y5AAmkbdHXEnBHxBfvDm7ze3p9Hqz0&api=1&no_preview=1#1 |
request | GET https://sun6-22.userapi.com/c235031/u44017378/docs/d4/1974a6683533/crypted.bmp?extra=XHKJoN80jGNAz1QmohIWSJwLNw1xbuFQMIVe0WiYZj62gT4pGvNZfyg4fHynhr0PlaBSK9k-uRbQkcGieK0oYQcB8CGDXqOb9JLjC38GlvNCMUriI1WLUKlrZb65vZcsrmYy1EOO8igzh7tD |
request | GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats |
request | GET https://vk.com/doc44017378_668790441?hash=ZAKf3wtiDekEKOwL5zOUpKlhs3NsBThU4THBbA9UjZ0&dl=tGcv3oqIrQKDSR0z8GXJxfn9P4s1HZm2ci3UQevYE7w&api=1&no_preview=1#test2 |
request | GET https://sun6-23.userapi.com/c240331/u44017378/docs/d40/ea107227b79a/test2.bmp?extra=T669DDPm8ZLFNZCYmG4ho1hhgwomS77jaE2Yn7VnIXwin8UREXNFw9ArqM4W0cg7xTW45XFbxsmQRIFsVfy1w7UsYsb0Uhx9j2OLuM-0E3RUf8vSZA5CNcinhMJmev2Nv1FGmFs4mSuLTip3 |
request | GET https://vk.com/doc44017378_668685574?hash=2Z9kWDMxHv9Bg52ieOFMjjyZlIe2LzZhpXJtbJfi2jD&dl=MckLSTrLnFqxzbDQcQsY8zw8KxvNLWnEyU8AMbhyK6s&api=1&no_preview=1#WW1 |
request | GET https://sun6-21.userapi.com/c909628/u44017378/docs/d11/ac2bb3ec415d/WWW1.bmp?extra=PdcCi5Du3aPXs6h3g6zfZQ1vp80eYhCaeQWYwshlaKabq3cItIQbRsgtJq0TWtJ44yhs8vYSoCXkcJ9B1aoCxAqw1FzxTuOWr37cbrEr81UIcHuZxy3avmSshVlPZDeDf90bALLE9p_SrNDd |
request | GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test |
request | GET https://db-ip.com/demo/home.php?s=175.208.134.152 |
request | GET https://db-ip.com/ |
request | POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self |
request | POST http://94.142.138.113/api/firegate.php |
request | POST http://45.15.156.229/api/firegate.php |
request | POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self |
domain | preconcert.pw | description | Palau domain TLD |
domain | ipinfo.io |
file | C:\Users\test22\AppData\Local\Temp\7zE0B8024CA\File.exe |
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Run a KeyLogger | rule | KeyLogger |
host | 149.202.0.242 | |||
host | 163.123.143.4 | |||
host | 176.123.9.142 | |||
host | 185.225.73.32 | |||
host | 194.169.175.128 | |||
host | 194.26.135.162 | |||
host | 45.15.156.229 | |||
host | 77.91.68.238 | |||
host | 87.121.221.58 | |||
host | 94.142.138.113 |
dead_host | 194.26.135.162:41140 |
dead_host | 163.123.143.4:80 |