Extracted

• • Target
    e516a2b83ff3ee2cfe9eff0b7f8794f26f4da204ddfad9975935909917f07e4a.exe
  • Size 5.4MB
  • SHA256 e516a2b83ff3ee2cfe9eff0b7f8794f26f4da204ddfad9975935909917f07e4a
  • MD5 d5076e95a64d1e8b3b5545f8f9a2dd6b
  • SHA1 37cc29c3d8629d842496757048c3b17a7dd1d4ce
  • SHA512 e99e606be1fce3e2bda1d0fad008b6971eb2a00a7a977c21104f943518ddac381452c247cd4d8381633f81791a78be546a3a1afc5dda44cdea4ff9947539970f
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMx:9XhICteErownP0oTcMsABqlDQkS
  • TLSH
    T164463308B3A80DE1EAB3D13981665621D473B4254BB0D1CF43AC96662F677E0BF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2