Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    9349d7fc1615c0b311da030f3dcc92ac91b6c92b4b12b1cae9beb3d4b9b47632.exe
  • Size 5.4MB
  • SHA256 9349d7fc1615c0b311da030f3dcc92ac91b6c92b4b12b1cae9beb3d4b9b47632
  • MD5 b552ff7866f2de0a4fd97feb40169b81
  • SHA1 a9bd7afd375ec4ec41062c58dc1ad5ec2fcc4103
  • SHA512 0d98e246242b37a65bb4c2d766d8450727eee1a2933443f99f2bf4d4eea242a9f859637fbfaa2ea89377ea7d7f259e5e691c2acd14b40c6429436825248051f5
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRH:OrICteErownP0oTcMsABqlaOzN
  • TLSH
    T1A5463308B3E808E2EAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7B750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2