Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | July 8, 2024, 11:07 a.m. | July 8, 2024, 11:09 a.m. |
IP Address | Status | Action |
---|---|---|
104.21.66.124 | Active | Moloch |
104.26.4.15 | Active | Moloch |
162.159.135.233 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.67.132.113 | Active | Moloch |
172.67.75.163 | Active | Moloch |
173.231.16.77 | Active | Moloch |
176.111.174.109 | Active | Moloch |
182.162.106.144 | Active | Moloch |
182.162.106.33 | Active | Moloch |
185.199.111.133 | Active | Moloch |
34.117.186.192 | Active | Moloch |
43.153.49.49 | Active | Moloch |
5.42.99.177 | Active | Moloch |
77.105.133.27 | Active | Moloch |
77.91.77.80 | Active | Moloch |
80.78.242.100 | Active | Moloch |
87.240.129.133 | Active | Moloch |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49186 104.26.4.15:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=db-ip.com | 1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25 |
TLSv1 192.168.56.102:49179 172.67.75.163:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=myip.com | 87:d2:90:92:b6:6a:56:3c:25:f1:ae:56:52:d9:2b:ac:16:44:bb:bc |
TLSv1 192.168.56.102:49229 104.21.66.124:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=foxesjoy.com | 98:61:17:75:9f:9b:34:ec:5e:dd:5b:36:49:5e:1b:7d:2d:22:18:22 |
TLSv1 192.168.56.102:49240 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49244 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49245 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49246 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49260 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49256 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
TLSv1 192.168.56.102:49263 172.67.132.113:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=iplogger.org | d8:ec:fc:e7:1f:4d:3a:fd:89:ef:f1:f1:1a:93:1b:94:db:b5:87:ec |
TLSv1 192.168.56.102:49257 87.240.129.133:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd |
suspicious_features | Connection to IP address | suspicious_request | GET http://5.42.99.177/api/crazyfish.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://5.42.99.177/api/twofish.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://77.105.133.27/download/123p.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://77.105.133.27/download/th/space.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://80.78.242.100/d/385132 | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://80.78.242.100/d/525403 | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://176.111.174.109/psyzh | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://43.153.49.49:8888/down/0GPThy6iSZBT.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://80.78.242.100/d/525403 | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://77.105.133.27/download/123p.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://176.111.174.109/psyzh | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://77.105.133.27/download/th/space.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://80.78.242.100/d/385132 |
request | GET http://5.42.99.177/api/crazyfish.php |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | POST http://5.42.99.177/api/twofish.php |
request | HEAD http://77.105.133.27/download/123p.exe |
request | HEAD http://77.105.133.27/download/th/space.php |
request | HEAD http://80.78.242.100/d/385132 |
request | HEAD http://80.78.242.100/d/525403 |
request | HEAD http://176.111.174.109/psyzh |
request | HEAD http://43.153.49.49:8888/down/0GPThy6iSZBT.exe |
request | GET http://80.78.242.100/d/525403 |
request | GET http://77.105.133.27/download/123p.exe |
request | GET http://176.111.174.109/psyzh |
request | GET http://77.105.133.27/download/th/space.php |
request | GET http://80.78.242.100/d/385132 |
request | GET https://db-ip.com/demo/home.php?s= |
request | GET https://lop.foxesjoy.com/ssl/crt.exe |
request | POST http://5.42.99.177/api/twofish.php |
domain | ipinfo.io |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\setup.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (12) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\ResIL.dll |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (11) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (6).exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\vivoxsdk.dll |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (7) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (8) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (13) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (6) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (5).exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (2) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (10) — копия.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\libGLESv2.dll |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (7).exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\res_mods\1.23.0.0\scripts\client\gui\mods\7zA.exe |
file | C:\Users\test22\AppData\Local\Temp\7zE8985C7A1\update\Uninstall\unins000 — копия (9) — копия.exe |
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Run a KeyLogger | rule | KeyLogger |
host | 176.111.174.109 | |||
host | 43.153.49.49 | |||
host | 5.42.99.177 | |||
host | 77.105.133.27 | |||
host | 77.91.77.80 | |||
host | 80.78.242.100 |
dead_host | 77.91.77.80:80 |