Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    8521df9c509e83d2812fcae59a9fe3d69c98ae7dd65bbf028a0ce43aebeda3d7.exe
  • Size 5.4MB
  • SHA256 8521df9c509e83d2812fcae59a9fe3d69c98ae7dd65bbf028a0ce43aebeda3d7
  • MD5 959266c1f29933be6ef7984da2cff270
  • SHA1 08c273e4c219577fdfa03754500245755f92a823
  • SHA512 06f0f51ef725699d121ce31463eb936ed95d3384eede66ed3a1077468fabd36cbcc29f79c1453f29a5bd50e6e39dba69ebfc52cb01c12a00526f868211ff87bb
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRe:OrICteErownP0oTcMsABqlaOzI
  • TLSH
    T153463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2