Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    738b74f6344da88e3fd05aa9cdd61a0827c12b35a4141f43727c1382a468c80f.exe
  • Size 5.4MB
  • SHA256 738b74f6344da88e3fd05aa9cdd61a0827c12b35a4141f43727c1382a468c80f
  • MD5 96ec6ec84938fe4d4df8b4a6689b6e32
  • SHA1 5e3774fdd3be0f8ccccc978f365ced68a8597d47
  • SHA512 ce6a06b66b686d8adbd2bb0b07392827bb7f2a4a3ae9bbc99480aca2c3ccc17a0f111730b570018a3fd8f24d476983dabf70feb9fd8f72fbe196d418ff3bbb54
  • SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1l:Hdx2ICteErownP0oTcMsABqlqBnX
  • TLSH
    T160463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2