Executes dropped EXE

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Loads dropped DLL

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious use of NtSetInformationThreadHideFromDebugger