Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    366ba79f51c18f8161839a8595ada9de32f2f3fa1e53c0bd0a8634ab01ebe6ef.exe
  • Size 5.4MB
  • SHA256 366ba79f51c18f8161839a8595ada9de32f2f3fa1e53c0bd0a8634ab01ebe6ef
  • MD5 3a7e2960045cada3b1158e73bbc28ae6
  • SHA1 716ec40f29afdf3d581480355cd584cf48f5ed1a
  • SHA512 084011a8d247bf4523d6f44bed6880430be6d59531191e781cc78c69611dd3a48b95771116ef13db1663e0fd72f76ca7e287dfaf9b482669782ab8b84d040453
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRv:OrICteErownP0oTcMsABqlaOzp
  • TLSH
    T126463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2