Extracted

• • Target
    5474d9b749ec87439e5d764b5696a8973cc20ef8c7f50f8f9b2e97e73cabf675.exe
  • Size 5.4MB
  • SHA256 5474d9b749ec87439e5d764b5696a8973cc20ef8c7f50f8f9b2e97e73cabf675
  • MD5 ad33a58c41e8420b43d7969ac250e517
  • SHA1 e48d3e9a828042dc9529f4816b0792edc8c3f9cd
  • SHA512 83dfd8d71813d3fd8ef506c40b20e2119c8844387cbfbdca66401b34eec081dd185383d53a4241275aa8ea17c034ccffeb7edd01c126d5670c98b04ed88d5bb0
  • SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66hY8:n4ICteErownP0oTcMsABqlTm6L
  • TLSH
    T19F463348B3E809E1FAB3D539856A5221D472B52547B0D1CF03AC9A662F677E0AF3F710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2