Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    62d7f10577fcc39a6daab6641d103c95a4ae4ecf81dac50b180403ecbf9de1a7.exe
  • Size 5.4MB
  • SHA256 62d7f10577fcc39a6daab6641d103c95a4ae4ecf81dac50b180403ecbf9de1a7
  • MD5 33ca87d04decfbd237d4e56f5cf8ec7e
  • SHA1 51a59a2a1537098ef1370c9b58e358eb33bbc751
  • SHA512 5fa77ba7352c1842823fe6b99f326e05137dd49cddce301b62edff092cf004c5d06176bda9db73a1e6f9f3225143a238822fcff61bc05c3f1cc3a1620713911a
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6toN:GiiICteErownP0oTcMsABqlAuctA
  • TLSH
    T1CE463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2