Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    64be2449cd55ae5acdc44f0106d5c45c899c3f5b9ff1e1f76e423f6ddd0d5056.exe
  • Size 5.4MB
  • SHA256 64be2449cd55ae5acdc44f0106d5c45c899c3f5b9ff1e1f76e423f6ddd0d5056
  • MD5 230ab70e10c0ed44a2b7e03521b2073b
  • SHA1 b03e9de511ac08eb63a82674d891cbbabf081721
  • SHA512 714a4ed42f70a365f3163678391437414f924da25664ae5130db944fb87c2ef3a25be1a66c2c2538cfe568ae27802c5878b4ee45211cdb9c983be47f94c137ee
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zR9:OrICteErownP0oTcMsABqlaOzz
  • TLSH
    T15C463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2