Extracted

Extracted

• • Target

    assessment64.xll

  • Size

    830KB

  • MD5

    3e1b5377a2528e4f4541a48f4246c4b6

  • SHA1

    a5006817c572c026392c10fcbe150a7112410703

  • SHA256

    3f9676555981d37686c259f38f3311b92b3a771ce81373aefb2a5ad5216cfdf9

  • SHA512

    0fb943e04f9874e90a6e60417c67d2cea07e048681a87d2cb4624c9166e7d506e7173e78852513b742dc2cd7f299d1595216bfdfe57f6281be10899c6448f884

  • SSDEEP

    12288:5G1N4HkcgMsiOd58bzbBSrepQ0uqZzD1reWabd/InCpbhc3miT9ekVF/Tx7:5oOOMX15+QHT+dgCbhcbeyF7x

  Score

  10^/10

  evasiontrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2