Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06.exe
  • Size 5.4MB
  • SHA256 d4f8a9762e0767136391b1e61df3ebe18c7dfa4edf86fc383124564899ef2b06
  • MD5 acaff044266b5e5b2204e70ac22efc0e
  • SHA1 81f9039cb6d8ec2fd35bccd777320a71739c2de4
  • SHA512 427ebe3aaaa7d57221c2ce2adf20f9e7ccdbbeaa5ef7f96356a7a7539909772aa8cb8e53ee4d7cb5dccada74072b64f81b0a66ef9ae468e8eb5a16ec56d22302
  • SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6up:AsTICteErownP0oTcMsABqljki
  • TLSH
    T171463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2