Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    c6a78636b114fcd031f5ca8f8a7720d2255b04f31b6693796c7d19bd2dcaf5a1.exe
  • Size 5.4MB
  • SHA256 c6a78636b114fcd031f5ca8f8a7720d2255b04f31b6693796c7d19bd2dcaf5a1
  • MD5 3532a48fe4f690a67481ff53b067cd3c
  • SHA1 ac65418268f26528151310c9ef92b5c2b6a86456
  • SHA512 6467c759e3d5c0ff6298a33a49ab2b888cc7ac0836c8db5cbd2e5795e4acb2e83eb3efb9eb47b213a9c9aca9601ed9adbc7eccfe42112410cd3d18a76565dcdd
  • SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1J:Hdx2ICteErownP0oTcMsABqlqBnr
  • TLSH
    T183463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2