Extracted

• • Target
    046fad34309da06d259d6e128944975e16c28a3112a7444cb2ccea9b3dac3a6a.exe
  • Size 5.4MB
  • SHA256 046fad34309da06d259d6e128944975e16c28a3112a7444cb2ccea9b3dac3a6a
  • MD5 48eab20676c6931e5bda9522657c0e05
  • SHA1 e0fec80a31dad217da0590db8f57b49f6775b705
  • SHA512 384e168e0dbfc6163761c025e61eed42724cb73337556b9e4e7320a48dc5ccd69c968e3f41cf0a9fe10da30b8a5b5980ee3cb230d533caf2dd9d3508a6ed9489
  • SSDEEP 98304:wxgtRdICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllpH5MuM6U9j:pRdICteErownP0oTcMsABqlK8Ut
  • TLSH
    T19E463304B3A809E5F6B3D039856A5221D972B4254BB4D1CF036C9B662F677E0BF3BB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2