Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | June 12, 2024, 3:13 p.m. | June 12, 2024, 3:15 p.m. |
IP Address | Status | Action |
---|---|---|
104.192.141.1 | Active | Moloch |
104.21.4.208 | Active | Moloch |
104.21.66.124 | Active | Moloch |
104.237.62.213 | Active | Moloch |
104.26.5.15 | Active | Moloch |
104.26.9.59 | Active | Moloch |
104.71.154.102 | Active | Moloch |
121.254.136.9 | Active | Moloch |
125.253.92.50 | Active | Moloch |
147.45.47.126 | Active | Moloch |
149.154.167.99 | Active | Moloch |
162.159.130.233 | Active | Moloch |
164.124.101.2 | Active | Moloch |
182.162.106.33 | Active | Moloch |
185.199.111.133 | Active | Moloch |
23.33.184.247 | Active | Moloch |
34.117.186.192 | Active | Moloch |
5.42.66.10 | Active | Moloch |
5.42.99.177 | Active | Moloch |
77.91.77.80 | Active | Moloch |
87.240.132.72 | Active | Moloch |
88.218.93.76 | Active | Moloch |
95.217.135.112 | Active | Moloch |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49219 104.21.66.124:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=foxesjoy.com | 98:61:17:75:9f:9b:34:ec:5e:dd:5b:36:49:5e:1b:7d:2d:22:18:22 |
TLSv1 192.168.56.102:49180 104.26.9.59:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=myip.com | 87:d2:90:92:b6:6a:56:3c:25:f1:ae:56:52:d9:2b:ac:16:44:bb:bc |
TLSv1 192.168.56.102:49186 104.26.5.15:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=db-ip.com | 1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25 |
TLSv1 192.168.56.102:49237 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49239 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49247 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49249 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49262 104.21.4.208:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=iplogger.org | d8:ec:fc:e7:1f:4d:3a:fd:89:ef:f1:f1:1a:93:1b:94:db:b5:87:ec |
TLS 1.3 192.168.56.102:49271 125.253.92.50:443 |
None | None | None |
TLSv1 192.168.56.102:49245 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49250 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49266 104.71.154.102:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA | unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com | 10:20:2b:ee:30:69:cc:b6:ac:5e:47:04:71:ca:b0:75:78:51:58:f5 |
suspicious_features | Connection to IP address | suspicious_request | GET http://5.42.99.177/api/crazyfish.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://5.42.99.177/api/twofish.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://5.42.66.10/download/123p.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://88.218.93.76/d/385135 | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://77.91.77.80/rome/kenzo.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://5.42.66.10/download/th/space.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://77.91.77.80/rome/kenzo.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://88.218.93.76/d/385135 | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://5.42.66.10/download/th/space.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://5.42.66.10/download/123p.exe | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET https://steamcommunity.com/profiles/76561199698764354 |
request | GET http://5.42.99.177/api/crazyfish.php |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | POST http://5.42.99.177/api/twofish.php |
request | HEAD http://5.42.66.10/download/123p.exe |
request | HEAD http://88.218.93.76/d/385135 |
request | HEAD http://77.91.77.80/rome/kenzo.exe |
request | HEAD http://5.42.66.10/download/th/space.php |
request | GET http://77.91.77.80/rome/kenzo.exe |
request | GET http://88.218.93.76/d/385135 |
request | GET http://5.42.66.10/download/th/space.php |
request | GET http://5.42.66.10/download/123p.exe |
request | GET https://db-ip.com/demo/home.php?s= |
request | GET https://lop.foxesjoy.com/ssl/crt.exe |
request | GET https://steamcommunity.com/profiles/76561199698764354 |
request | POST http://5.42.99.177/api/twofish.php |
domain | ipinfo.io |
file | C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\msvcp140.dll |
file | C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\concrt140.dll |
file | C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\file.exe |
file | C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\amdhip64.dll |
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Run a KeyLogger | rule | KeyLogger |
host | 147.45.47.126 | |||
host | 5.42.66.10 | |||
host | 5.42.99.177 | |||
host | 77.91.77.80 | |||
host | 88.218.93.76 | |||
host | 95.217.135.112 |