Extracted

• • Target
    4a948acdda579cbb5d4629b62d9957d32698b4b1e6df1b64e1c407abf8b3d2c8.exe
  • Size 5.4MB
  • SHA256 4a948acdda579cbb5d4629b62d9957d32698b4b1e6df1b64e1c407abf8b3d2c8
  • MD5 7ce943deb3cd76d67a4be8df81b7faec
  • SHA1 f9fb6abbd18faaa2895a3c12be5ea9d993146985
  • SHA512 0ca03d86c40bdc448664dd574dd0886c2cbf8100dff398434b6403faee27abb67a8b551b880c82a67f6819756f260d1ee8dfcb3a7da31a45b7e525d4270b4922
  • SSDEEP 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61FO:Tt7ICteErownP0oTcMsABqloOc1A
  • TLSH
    T1E5463308B3A80CE1FAB3E13885565621D973B42547B0D1CF43AC9A662F677E0AF3E754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2