Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    7003e6cc6b2bfe1f74b449544f88c40c14b6049e53732e118b1c05fc90d806b0.exe
  • Size 5.4MB
  • SHA256 7003e6cc6b2bfe1f74b449544f88c40c14b6049e53732e118b1c05fc90d806b0
  • MD5 3b28b7446376faf9faf1e6fe4197e3d5
  • SHA1 1b565302c5ad6730a0199b6f948de355b92401c4
  • SHA512 5656417263bd4e57f6b016d6c67f7efbffe1f2344cbc5170a8d4edcd39f4f26f4f8fe9201083a29cfb73ae2575116d2d815b606c0a2b2eb946fb80771dda8ce9
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zR3:OrICteErownP0oTcMsABqlaOzx
  • TLSH
    T150463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2