Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    8e2542775e30899cf963dc90628a426c91f72b700097607bc7489a36ba11c7a0.exe
  • Size 5.4MB
  • SHA256 8e2542775e30899cf963dc90628a426c91f72b700097607bc7489a36ba11c7a0
  • MD5 69d2a9baf6a6c9a20b0ec171c81a826b
  • SHA1 1a35eab0d503f7a6ab2a8099ac66bbddbab547b3
  • SHA512 e9cb6899b5bea05268767596613dc8ceb22c4cfdf169b9eae79b64948319fafe2cd486448604e868fe0bdc1b7cb52f7ed4c13ea3ba1885b83c322eb242d24b69
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6toA:GiiICteErownP0oTcMsABqlAuctF
  • TLSH
    T1E4463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2