Extracted

• • Target
    481ec997f1da724584c47a159f264d73ba81261aaab0fbb3f959955da10bd2ef.exe
  • Size 5.4MB
  • SHA256 481ec997f1da724584c47a159f264d73ba81261aaab0fbb3f959955da10bd2ef
  • MD5 f2f7f9723ff984ae06ea408431ef0bab
  • SHA1 368afdcf0b13d4d0bb8e1fd4c1f050d03d4d8c0a
  • SHA512 57336b9a066f6b29b1acbad5b8e47b6bb6aa8927d4e1092a667d6a20b084048b158c29e93e67ea44988404008fc7d50627c9591ec90d5fc23ac1d83ffd8a4011
  • SSDEEP 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61Fg:Tt7ICteErownP0oTcMsABqloOc1y
  • TLSH
    T15F463308B3A80CE1FAB3E13885565621D973B42547B0D5CF43AC9A662F677E0AF3E750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2