Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | Dec. 11, 2023, 2:19 p.m. | Dec. 11, 2023, 2:21 p.m. |
IP Address | Status | Action |
---|---|---|
104.21.37.196 | Active | Moloch |
104.21.46.59 | Active | Moloch |
104.21.63.150 | Active | Moloch |
104.26.5.15 | Active | Moloch |
104.26.9.59 | Active | Moloch |
109.107.182.3 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.67.132.113 | Active | Moloch |
185.216.70.235 | Active | Moloch |
193.233.132.34 | Active | Moloch |
193.233.132.51 | Active | Moloch |
194.49.94.97 | Active | Moloch |
195.20.16.45 | Active | Moloch |
23.43.165.105 | Active | Moloch |
34.117.59.81 | Active | Moloch |
5.42.64.35 | Active | Moloch |
5.42.64.41 | Active | Moloch |
87.240.132.67 | Active | Moloch |
87.240.132.72 | Active | Moloch |
91.215.85.209 | Active | Moloch |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49177 104.26.9.59:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65 |
TLSv1 192.168.56.102:49202 104.21.37.196:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=ioiouoiuououiyjgroup.sbs | 69:14:e0:4f:aa:e6:f1:e1:6f:18:48:7e:74:8a:c3:2a:f0:2e:53:a4 |
TLSv1 192.168.56.102:49305 104.21.63.150:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=iplis.ru | 04:2b:ef:ab:43:60:60:33:69:03:f3:51:37:11:c8:29:26:89:a4:93 |
TLSv1 192.168.56.102:49308 104.26.5.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49309 172.67.132.113:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=iplogger.org | 1e:76:b5:78:be:35:ec:fb:3f:26:d0:5f:1c:2a:2d:33:0e:51:6f:7e |
suspicious_features | Connection to IP address | suspicious_request | GET http://195.20.16.45/api/tracemap.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://195.20.16.45/api/firegate.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://5.42.64.35/timeSync.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://193.233.132.34/autorun.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://109.107.182.3/moda/good.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://5.42.64.35/timeSync.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://109.107.182.3/moda/good.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://193.233.132.34/autorun.exe | ||||||
suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://5.42.64.41/40d570f44e84a454.php | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/sqlite3.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/freebl3.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/mozglue.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/msvcp140.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/nss3.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/softokn3.dll | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://5.42.64.41/2a7743b8bbd7e4a7/vcruntime140.dll |
request | GET http://195.20.16.45/api/tracemap.php |
request | POST http://195.20.16.45/api/firegate.php |
request | HEAD http://5.42.64.35/timeSync.exe |
request | HEAD http://193.233.132.34/autorun.exe |
request | HEAD http://109.107.182.3/moda/good.exe |
request | HEAD http://never.hitsturbo.com/order/tuc6.exe |
request | GET http://5.42.64.35/timeSync.exe |
request | GET http://109.107.182.3/moda/good.exe |
request | GET http://never.hitsturbo.com/order/tuc6.exe |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET http://193.233.132.34/autorun.exe |
request | POST http://5.42.64.41/40d570f44e84a454.php |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/sqlite3.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/freebl3.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/mozglue.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/msvcp140.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/nss3.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/softokn3.dll |
request | GET http://5.42.64.41/2a7743b8bbd7e4a7/vcruntime140.dll |
request | GET https://api.myip.com/ |
request | GET https://IOIOUOIUOUOUIYJGROUP.SBS/setup294.exe |
request | GET https://iplis.ru/1Gemv7.mp3 |
request | GET https://db-ip.com/demo/home.php?s=175.208.134.152 |
request | POST http://195.20.16.45/api/firegate.php |
request | POST http://5.42.64.41/40d570f44e84a454.php |
domain | iplis.ru | description | Russian Federation domain TLD |
domain | ipinfo.io |
file | C:\Users\test22\AppData\Local\Temp\7zEC882990D\File.exe |
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Run a KeyLogger | rule | KeyLogger |
host | 109.107.182.3 | |||
host | 185.216.70.235 | |||
host | 193.233.132.34 | |||
host | 193.233.132.51 | |||
host | 194.49.94.97 | |||
host | 195.20.16.45 | |||
host | 5.42.64.35 | |||
host | 5.42.64.41 |
dead_host | 194.49.94.97:80 |