Extracted

• • Target
    51cc25b1e0abdbdc3c21a02a5e142b84c870024c95b2ee4dc6c99295ab40d493.exe
  • Size 5.4MB
  • SHA256 51cc25b1e0abdbdc3c21a02a5e142b84c870024c95b2ee4dc6c99295ab40d493
  • MD5 0631c2d3a8b0169a01ac2ee74e73810f
  • SHA1 f8fe4e689b22e6088a3ab5db8a25894ce81af23e
  • SHA512 103c9f3cb1448994a83f787c1e92b79cd420afe1078d287581dce42208b7c90132ba91b0abd9fbdcf8c2079833d1b65b4a3a0526085e14191c3c327d67424452
  • SSDEEP 98304:lmgtRQDgICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlollloHFMIQ6UDD:JiDgICteErownP0oTcMsABqlfiUf
  • TLSH
    T181463308B3E819E5FAB3D43D85665221D972742547F0D1CF03AC9A662F236E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2