Extracted

• • Target
    e31ac0403851d7dbfa2034b8725633fd6971506f2e4aa69e603d7a72690644d7.exe
  • Size 5.4MB
  • SHA256 e31ac0403851d7dbfa2034b8725633fd6971506f2e4aa69e603d7a72690644d7
  • MD5 cb1ce1b1d0aafb12f44ba47311b1f6cd
  • SHA1 bc0451dac22b10db05109710b09fa5ffef153d78
  • SHA512 06e26413488b1f2255cdc3cd8588dd677f79150c4dd60bd8d23126d669edacbd024aea57f432a02ec24a9130a6db93c13b491f58947353f3d214516fea991cdd
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMF:9XhICteErownP0oTcMsABqlDQk8
  • TLSH
    T12B463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2