Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    3586673e0818a248cc970c348b3fd07981c841bea215e2eea2b595d089214ade.exe
  • Size 5.4MB
  • SHA256 3586673e0818a248cc970c348b3fd07981c841bea215e2eea2b595d089214ade
  • MD5 e4109a6ace03a57355961af6a66901c1
  • SHA1 758474fbb1b321423f68f8aad9408bb52bd7c254
  • SHA512 3b1dbfc70cf57800c558799a3f871b18cc7c9599251d27d457ace4314ec583ccbc37357b7013ef979a3f40ce41acdab073fe4905aa5b2d3cbdc59e3a261df052
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRp:OrICteErownP0oTcMsABqlaOzz
  • TLSH
    T126463308B3E808E2EAB3D53D81565221D472B4254BB0D5CF43AC9B762F677E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2