Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    4fd15f7f7c49ebc762c2870a64239b7bd0a6060cac8da1d825b4cc6dd6649a49.exe
  • Size 5.4MB
  • SHA256 4fd15f7f7c49ebc762c2870a64239b7bd0a6060cac8da1d825b4cc6dd6649a49
  • MD5 6e61655437e3b23c55626a37cf207adc
  • SHA1 708a77f641bb2ab30c3e0407e8d919db9ecefb83
  • SHA512 3b649abb9cd10023522ac0d00533f836963eb05dc1f37eb02f673d3d073d088433d0e89d4c13a6736abd7f391afc1fa984c2eb483b6e6d7e65c7bd0221ce9b26
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRA:OrICteErownP0oTcMsABqlaOz2
  • TLSH
    T1A0463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2