Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    abcf9a2b2c766e2d29ff6bb8385c8136054b702632b79728dbc1f4b4e290066c.exe
  • Size 5.4MB
  • SHA256 abcf9a2b2c766e2d29ff6bb8385c8136054b702632b79728dbc1f4b4e290066c
  • MD5 4c40abdcede55297070b4d77c1b4899e
  • SHA1 a62060d70ed86cde6f346eecca5143dec27f8242
  • SHA512 49153e0f980194de56856861fa2562eaea5283c5bfd6ddb7de5f846e40c40c33a812df97fd276ff27fdc8f6808edef27b60f4af00ece7cfacc41284d60eaeb61
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6toR:GiiICteErownP0oTcMsABqlAuctK
  • TLSH
    T116463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2