Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | April 26, 2021, 3:32 p.m. | April 26, 2021, 3:34 p.m. |
-
-
regasm3.exe "C:\Users\test22\AppData\Local\Temp\regasm3.exe"
2076
-
Name | Response | Post-Analysis Lookup |
---|---|---|
bncoporations.cf |
IP Address | Status | Action |
---|---|---|
164.124.101.2 | Active | Moloch |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.101:61479 -> 164.124.101.2:53 | 2025107 | ET INFO DNS Query for Suspicious .cf Domain | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | .ndata |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Users\test22\AppData\Local\Temp\nse6404.tmp\dmp1lokjn.dll |
file | C:\Users\test22\AppData\Local\Temp\nse6404.tmp\dmp1lokjn.dll |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
Bkav | W32.AIDetect.malware1 |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Trojan.GenericKD.46154797 |
FireEye | Generic.mg.92ac3623e3748c80 |
CAT-QuickHeal | Trojan.Spynoon |
McAfee | RDN/Generic.tfr |
Cylance | Unsafe |
VIPRE | Trojan.Win32.Generic!BT |
Sangfor | Trojan.Win32.Save.a |
K7AntiVirus | Riskware ( 0040eff71 ) |
Alibaba | Backdoor:Win32/Fareit.1dfcf4b7 |
K7GW | Riskware ( 0040eff71 ) |
Cybereason | malicious.dd8ad9 |
Cyren | W32/Injector.AHE.gen!Eldorado |
Symantec | Trojan.Gen.2 |
ESET-NOD32 | Win32/PSW.Fareit.L |
APEX | Malicious |
Avast | Win32:PWSX-gen [Trj] |
Kaspersky | HEUR:Backdoor.Win32.Androm.gen |
BitDefender | Trojan.GenericKD.46154797 |
Paloalto | generic.ml |
Tencent | Win32.Backdoor.Fareit.Auto |
Ad-Aware | Trojan.GenericKD.46154797 |
Sophos | Mal/Generic-S |
Comodo | Malware@#1dyrnuu6n9v1y |
McAfee-GW-Edition | BehavesLike.Win32.ICLoader.cc |
Emsisoft | Trojan.GenericKD.46154797 (B) |
Ikarus | Trojan.Win32.Injector |
Webroot | W32.Trojan.Gen |
Avira | TR/AD.LokiBot.wkfyj |
Kingsoft | Win32.Troj.Generic_a.a.(kcloud) |
Gridinsoft | Trojan.Win32.Agent.oa |
Microsoft | Trojan:Win32/Spynoon.VAM!MTB |
GData | Win32.Trojan-Stealer.LokiBot.7D3XFP |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Malware/Gen.RL_Reputation.R364385 |
ALYac | Trojan.GenericKD.46154797 |
Malwarebytes | Trojan.Injector.DL |
Rising | Trojan.Injector!8.C4 (TFE:5:CSdS0rhF37Q) |
SentinelOne | Static AI - Suspicious PE |
Fortinet | W32/KRYPTIK.AHD!tr |
AVG | Win32:PWSX-gen [Trj] |
Panda | Trj/CI.A |
CrowdStrike | win/malicious_confidence_100% (W) |