Extracted

• • Target
    e13aa14f3ad2bbfabb6b3d1c7c73f853c5f0a9381825c61fed77a3232c4b7717.exe
  • Size 5.4MB
  • SHA256 e13aa14f3ad2bbfabb6b3d1c7c73f853c5f0a9381825c61fed77a3232c4b7717
  • MD5 7be5df47aa4971c09d26c6ef28ce59cc
  • SHA1 958f1c2e93de68c7cc122262f6c88f98a3012798
  • SHA512 a8b2df4571a04d973b3b110ecaed8409d5c542d17c0904d373958baf314be2f034346f689507ce72e948a1d263c8caa57f78e7209ae1a5df15e11ab05c582c03
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kME:9XhICteErownP0oTcMsABqlDQkL
  • TLSH
    T103463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2