Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Nov. 3, 2023, 12:03 p.m. | Nov. 3, 2023, 12:09 p.m. |
-
-
-
apfqntkkhs.exe "C:\Users\test22\AppData\Local\Temp\apfqntkkhs.exe"
2720
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
www.rollesgraciejiujitsu.com |
CNAME
s.multiscreensite.com
|
3.67.141.185 |
www.flowersinspace.tech | ||
www.docomo-mobileconsulting.com | 64.190.63.111 | |
www.vandistreet.com |
CNAME
shops.myshopify.com
|
23.227.38.74 |
www.displayfridges.fun |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49168 -> 23.227.38.74:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49169 -> 3.127.73.216:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
TCP 192.168.56.101:49167 -> 64.190.63.111:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
section | .ndata |
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.docomo-mobileconsulting.com/sy22/?GVW8=lVM1xi/uUQcXVrGb3v1MnIj4JTU8QNZxAwtnBLuxN6GTboe8PABHdOr2nABXcw5/boXeCr4R&uldX=kjFPdVD0hnWHFJ | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.vandistreet.com/sy22/?GVW8=ebYri2VV/sCK3b5rVJ3RboTDPGX+2LyTyMxHYnpzeShqSQ1cgB3Zd9ZvGXgE+e2ljlV5J+6Q&uldX=kjFPdVD0hnWHFJ | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.rollesgraciejiujitsu.com/sy22/?GVW8=wNOPQ9lPL0LlPifzaFD7oS/J4vOv5L9Eq5jAtNxi81+z9IaaPyU3XhbcbjJzUPxyEBlmVqqy&uldX=kjFPdVD0hnWHFJ |
request | GET http://www.docomo-mobileconsulting.com/sy22/?GVW8=lVM1xi/uUQcXVrGb3v1MnIj4JTU8QNZxAwtnBLuxN6GTboe8PABHdOr2nABXcw5/boXeCr4R&uldX=kjFPdVD0hnWHFJ |
request | GET http://www.vandistreet.com/sy22/?GVW8=ebYri2VV/sCK3b5rVJ3RboTDPGX+2LyTyMxHYnpzeShqSQ1cgB3Zd9ZvGXgE+e2ljlV5J+6Q&uldX=kjFPdVD0hnWHFJ |
request | GET http://www.rollesgraciejiujitsu.com/sy22/?GVW8=wNOPQ9lPL0LlPifzaFD7oS/J4vOv5L9Eq5jAtNxi81+z9IaaPyU3XhbcbjJzUPxyEBlmVqqy&uldX=kjFPdVD0hnWHFJ |
file | C:\Users\test22\AppData\Local\Temp\apfqntkkhs.exe |