Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    d649ab9bdc31e7e436c50bd09528fe61ae18645da2ef268a62e49c1f83f3f144.exe
  • Size 5.4MB
  • SHA256 d649ab9bdc31e7e436c50bd09528fe61ae18645da2ef268a62e49c1f83f3f144
  • MD5 112571db8cd273e8c6da0cef341e2385
  • SHA1 487c690e2f8ead1b3d92fdee5d32a520f53024ff
  • SHA512 6f0db04dd89c1e8b9c544574c21f9d337d47b80dcf1670455de2785c1fd83d013db03c893893af85f7a4830e9598a21ba13b5f6150372c4c7abd3a3e117d8a69
  • SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1J:Hdx2ICteErownP0oTcMsABqlqBnz
  • TLSH
    T1EA463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2