Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    e9b7cc07f31e6c8920073476e9dfcb94527432c52801325de773f259c2fc2530.exe
  • Size 5.4MB
  • SHA256 e9b7cc07f31e6c8920073476e9dfcb94527432c52801325de773f259c2fc2530
  • MD5 1f734b6cbc41c847a9ee5f0203e7cded
  • SHA1 0d7e379b32d4b2659fe68dd8877908600284b265
  • SHA512 36a2ef8e1bd51b2fdc87b4e9d4066c59297d89dd3ba6393911728b81675345dbd81f32f128c20e73bbc9f4ef6449927c266a54bd37738759bb6dbb50dde3ba3c
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6toJ:GiiICteErownP0oTcMsABqlAuctm
  • TLSH
    T1FC463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2