Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    451454a83e6aa93b32c8a4cfb1bfd38fb79cd9d86c311ac5119c4b0d7170bc60.exe
  • Size 5.4MB
  • SHA256 451454a83e6aa93b32c8a4cfb1bfd38fb79cd9d86c311ac5119c4b0d7170bc60
  • MD5 67e3c64a27e2f4a673882639be26a8e7
  • SHA1 4498def608dec3ed6145f18b3ed6053a04ebc900
  • SHA512 f1a59de731d7a4a1c5f8553d7279fa4797e43639bf7857d6b15f35caa0609a00c5708188874bcaa4e1eb012f0715bef0224a66d189063e80291f2bbfebba43f3
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRe:OrICteErownP0oTcMsABqlaOz0
  • TLSH
    T129463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2