Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    11e7c4a89bc56d4401f03a89088cb406f252a0c81c20630afa567172feaae5da.exe
  • Size 5.4MB
  • SHA256 11e7c4a89bc56d4401f03a89088cb406f252a0c81c20630afa567172feaae5da
  • MD5 d0308f1b53437ec7c4a1bef0eb634386
  • SHA1 2ee301a771251aaa9a9a93fd283ea883a73e04f0
  • SHA512 fae8f1a66b7ed61e9220436dbe4c588c798b6f419d76856ca01afb37d738afd9a7f32e539cdca569942eee81e70f7263739ca86167ad40250f2bdd2026839045
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRU:OrICteErownP0oTcMsABqlaOzW
  • TLSH
    T19D463308B3E808E2EAB3D53D81565221D472B4254BB0D5CF43AC9B762F677E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2