Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    47d8ec9b0cb2a90dcf913b8c427c99da243f954b6bbe940d41ac3ef2310a3309.exe
  • Size 5.4MB
  • SHA256 47d8ec9b0cb2a90dcf913b8c427c99da243f954b6bbe940d41ac3ef2310a3309
  • MD5 46d7495c52cf9311434dcdc74b21346c
  • SHA1 b62cfde1bc55f1a11c7d0e6eb4d20928252559f5
  • SHA512 e17f7ece131a356f290a65a9ddc9feb89823c7da7d28e3cb527c9e96b9ea5c568b89432485395a9850b1ef5cdb23f5aa17de8f281219573888615c97aff6f6fc
  • SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uG:AsTICteErownP0oTcMsABqljkd
  • TLSH
    T153463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2