Extracted

• • Target
    153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695.exe
  • Size 5.4MB
  • SHA256 153a4229ab727c23814d18a7c86d2f99d690d33e608b37bd67a06e9a8a3a5695
  • MD5 6a82d2d716d28e311fa90216fbc78dfc
  • SHA1 6d25f76325c3c307f68f6d3fed92e2d062ed85e0
  • SHA512 f9f9f2b4134440522c422cada3d0f32b925c86b6b17f21e4e77116b69a6155c29bd3d866d3a49cefc1c0dca465884cc237c4402ee81075e9b124439321cd7b8e
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMU:9XhICteErownP0oTcMsABqlDQkB
  • TLSH
    T1F7463308B3A80DE1FAB3D13981665221D473B5254BB0D1CF43AC96662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2