Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Feb. 9, 2023, 10:19 a.m. | Feb. 9, 2023, 10:34 a.m. |
-
-
odaeemxxl.exe "C:\Users\test22\AppData\Local\Temp\odaeemxxl.exe" C:\Users\test22\AppData\Local\Temp\fjlqm.qo
2640-
odaeemxxl.exe "C:\Users\test22\AppData\Local\Temp\odaeemxxl.exe"
2700
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
sempersim.su | 46.148.39.36 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.101:59002 -> 164.124.101.2:53 | 2014169 | ET DNS Query for .su TLD (Soviet Union) Often Malware Related | Potentially Bad Traffic |
UDP 192.168.56.101:59002 -> 8.8.8.8:53 | 2014169 | ET DNS Query for .su TLD (Soviet Union) Often Malware Related | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | .ndata |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Users\test22\AppData\Local\Temp\odaeemxxl.exe |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
dead_host | 46.148.39.36:80 |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Gen:Variant.Nemesis.16212 |
FireEye | Generic.mg.900820f261e82e5c |
McAfee | Artemis!900820F261E8 |
Cylance | Unsafe |
VIPRE | Gen:Variant.Nemesis.16212 |
Sangfor | Suspicious.Win32.Save.ins |
Cybereason | malicious.baa092 |
Arcabit | Trojan.Nemesis.D3F54 [many] |
BitDefenderTheta | Gen:NN.ZexaF.36276.iuW@a4d3uyk |
Cyren | W32/Trojan.FAER-6525 |
Symantec | Packed.NSISPacker!g14 |
ESET-NOD32 | a variant of Win32/Injector.ESQV |
APEX | Malicious |
Cynet | Malicious (score: 100) |
Kaspersky | UDS:Backdoor.Win32.Androm.gen |
BitDefender | Gen:Variant.Nemesis.16212 |
Avast | Win32:Evo-gen [Trj] |
Emsisoft | Gen:Variant.Nemesis.16212 (B) |
DrWeb | Trojan.Loader.1295 |
McAfee-GW-Edition | BehavesLike.Win32.Generic.dc |
Trapmine | malicious.moderate.ml.score |
Sophos | Generic ML PUA (PUA) |
SentinelOne | Static AI - Suspicious PE |
MAX | malware (ai score=87) |
Kingsoft | Win32.Heur.KVMH008.a.(kcloud) |
Microsoft | Trojan:Win32/Wacatac.B!ml |
GData | Gen:Variant.Jaik.95172 |
Detected | |
ALYac | Gen:Variant.Jaik.95172 |
Malwarebytes | Spyware.PasswordStealer |
Rising | Trojan.Generic@AI.91 (RDML:U4Z3SX0ihdd8CMLs4Raf7Q) |
Ikarus | Trojan.Inject |
AVG | Win32:Evo-gen [Trj] |