Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Feb. 2, 2023, 9:59 a.m. | Feb. 2, 2023, 10:01 a.m. |
-
-
lxzkrytqn.exe "C:\Users\test22\AppData\Local\Temp\lxzkrytqn.exe" C:\Users\test22\AppData\Local\Temp\zyman.on
2160-
lxzkrytqn.exe "C:\Users\test22\AppData\Local\Temp\lxzkrytqn.exe"
2252
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
185.246.220.85 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | .ndata |
suspicious_features | POST method with no referer header, HTTP version 1.0 used, Connection to IP address | suspicious_request | POST http://185.246.220.85/davidhill/five/fre.php |
request | POST http://185.246.220.85/davidhill/five/fre.php |
request | POST http://185.246.220.85/davidhill/five/fre.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Users\test22\AppData\Local\Temp\lxzkrytqn.exe |
host | 185.246.220.85 |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
file | C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email |
MicroWorld-eScan | Gen:Variant.Nemesis.15972 |
ALYac | Trojan.NSISX.Spy.Gen.24 |
Cylance | Unsafe |
Sangfor | Suspicious.Win32.Save.ins |
K7AntiVirus | Trojan ( 0059e6081 ) |
K7GW | Trojan ( 0059e6081 ) |
Cybereason | malicious.18c1aa |
Arcabit | Trojan.Nemesis.D3E64 [many] |
Cyren | W32/Injector.BJV.gen!Eldorado |
Symantec | Trojan.Gen.MBT |
Elastic | malicious (high confidence) |
ESET-NOD32 | a variant of Win32/Injector.ESPR |
Cynet | Malicious (score: 100) |
APEX | Malicious |
Kaspersky | UDS:DangerousObject.Multi.Generic |
BitDefender | Gen:Variant.Nemesis.15972 |
Avast | Win32:PWSX-gen [Trj] |
Emsisoft | Gen:Variant.Nemesis.15972 (B) |
F-Secure | Trojan.TR/Injector.xuuje |
DrWeb | Trojan.Loader.1283 |
VIPRE | Gen:Variant.Nemesis.15972 |
McAfee-GW-Edition | BehavesLike.Win32.ICLoader.cc |
Trapmine | malicious.moderate.ml.score |
FireEye | Generic.mg.a62b834fd42367f3 |
Sophos | Generic ML PUA (PUA) |
SentinelOne | Static AI - Suspicious PE |
Avira | TR/Injector.xuuje |
Antiy-AVL | GrayWare/Win32.Wacapew |
Microsoft | Trojan:Win32/Wacatac.B!ml |
ZoneAlarm | UDS:DangerousObject.Multi.Generic |
GData | Win32.Trojan-Stealer.LokiBot.CN3B1A |
Detected | |
AhnLab-V3 | Trojan/Win.Generic.R555667 |
McAfee | Artemis!A62B834FD423 |
MAX | malware (ai score=88) |
Malwarebytes | Generic.Malware/Suspicious |
Rising | Trojan.Injector!8.C4 (TFE:5:6vclCKtlZFE) |
Ikarus | Trojan.Inject |
Fortinet | W32/Injector.NSAY!tr |
AVG | Win32:PWSX-gen [Trj] |