Extracted

• • Target
    d4eeca8153d91503e6ca2c9d93a001250830f2001c76dc99dab11e368e82eec3.exe
  • Size 5.4MB
  • SHA256 d4eeca8153d91503e6ca2c9d93a001250830f2001c76dc99dab11e368e82eec3
  • MD5 c1dc830b478f2b7a3843ffe3e121f9b1
  • SHA1 f44fa48d1de4c97e1f2ae54f67ea372496089ba8
  • SHA512 8059535b6e31eb4f7ba51f5a8a88281d7924555554b76c4441ea1fe64488c0ac8abe423bb699dc28479ec5fc61609f3d0bd4d0c35962f6fd66959647af5b5b46
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMw:9XhICteErownP0oTcMsABqlDQk/
  • TLSH
    T102463308B3A80DE1F9B3D13981665621D473B4254BB0D1CF43AC9A662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2