Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    3850fb4483efa893f1580792773b24b3287706fdd4500336ce32ec8f6f1081fc.exe
  • Size 5.4MB
  • SHA256 3850fb4483efa893f1580792773b24b3287706fdd4500336ce32ec8f6f1081fc
  • MD5 c557df81e6b2a21bb9b1762efb89f9f4
  • SHA1 cbb2c4e134eaf7d8d18f84a52399416d7106f6f8
  • SHA512 215709d1b972c1be7abffdd49e8018f967a66c5ae1b859b5f32bb21f3606759d9b223cd7cf7f6197d361539195ad0f686852ab3da90860c9b6f6618690c02fb4
  • SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1K:Hdx2ICteErownP0oTcMsABqlqBnE
  • TLSH
    T1AD463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2