Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    e453529be1cdca6ab67baa6eda0638e3f1eab074663fbd0e2bb212ee13fa9c19.exe
  • Size 5.4MB
  • SHA256 e453529be1cdca6ab67baa6eda0638e3f1eab074663fbd0e2bb212ee13fa9c19
  • MD5 b500ddb493b1843840c0e8a0e0cfa120
  • SHA1 832a3a5222c9d0b4d71c871321fc8a149cb92cbc
  • SHA512 85ef0734eb678ffb396d7630ffb5b23950edb16867bf54818248f4fa8074cc308b052d64ce6db3ea863d2be71af0497da3a6e4e2d38c5be332c9291efc21b550
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6tob:GiiICteErownP0oTcMsABqlAuctU
  • TLSH
    T190463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2