Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    b5488c1d59bd2f3c1e5e1de960a8547105248071b04aa60219387aa66fc6c276.exe
  • Size 5.4MB
  • SHA256 b5488c1d59bd2f3c1e5e1de960a8547105248071b04aa60219387aa66fc6c276
  • MD5 a49020279e432cf4e8580ee919ffef8d
  • SHA1 3a872b029a8ea36035758db46cd516aadd1aa38b
  • SHA512 461c123d6d557aeea23ea2579307177292c537ecf6435fabe160b9725ce7623214067f30aa968bf00b12b5e22a3d4056e8ca1071fc534f490467dc13a827f19e
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRc:OrICteErownP0oTcMsABqlaOze
  • TLSH
    T1B3463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2