Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    0473b78021d65c631208d17a75a5e46c9f01e3457f36d5686d003137b418eda3.exe
  • Size 5.4MB
  • SHA256 0473b78021d65c631208d17a75a5e46c9f01e3457f36d5686d003137b418eda3
  • MD5 af6cefd331134d861b78600f19664745
  • SHA1 72ea555f77a3cb717bd60a0aca4bc66c49fbb518
  • SHA512 d6839dd87af84eeedfb199e7d32a3d5219e49f29931e825ccd33dac7eef6f285f86d49fca9aacccbc25cb5c263dae936de6145e1568106871ca4892e483172af
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6tog:GiiICteErownP0oTcMsABqlAuct9
  • TLSH
    T14D463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2