Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Sept. 22, 2024, 4:13 a.m. | Sept. 22, 2024, 4:15 a.m. |
-
2.exe "C:\Users\test22\AppData\Local\Temp\2.exe"
2556
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
139.196.224.137 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
packer | Armadillo v1.71 |
suspicious_features | Connection to IP address | suspicious_request | GET http://139.196.224.137:8080/NetSyst96.dll |
request | GET http://139.196.224.137:8080/NetSyst96.dll |
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00054650 | size | 0x00000128 | ||||||||||||||||||
name | RT_ICON | language | LANG_CHINESE | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00054650 | size | 0x00000128 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x000542a8 | size | 0x000000bc | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x000542a8 | size | 0x000000bc | ||||||||||||||||||
name | RT_STRING | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00054a60 | size | 0x0000003a | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00054778 | size | 0x00000022 | ||||||||||||||||||
name | RT_VERSION | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x000547a0 | size | 0x000002c0 |
file | C:\Program Files\AppPatch\NetSyst96.dll |
host | 139.196.224.137 |