Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    01b62e01d3b0253093c2dee97cfb65f77e1fd5a5e6c1a9681f998902ea13dd82.exe
  • Size 5.4MB
  • SHA256 01b62e01d3b0253093c2dee97cfb65f77e1fd5a5e6c1a9681f998902ea13dd82
  • MD5 e07b5f987c78d91d99e0b94f65537914
  • SHA1 6da4b6399b7f5521d45153731dfabf7f558c72d0
  • SHA512 8e722edcf1d70d2bfbb487cc76f115120a382d8b0395a77efe79e5d3a38c4e44f9fe3ece2889e68a8011a04693ed73b2ed817c37fafbc2acfe497e3f47b2f66b
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6too:GiiICteErownP0oTcMsABqlAuctx
  • TLSH
    T10F463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2