Extracted

• • Target
    5d899cd9835b97fd4c06947cf0e413ae2a5145127745986af2d2769d5442328c.exe
  • Size 5.4MB
  • SHA256 5d899cd9835b97fd4c06947cf0e413ae2a5145127745986af2d2769d5442328c
  • MD5 17f73fe08afaa2b09f4fe6cc9b1970dd
  • SHA1 37c0711e84da55c735b45bee9e542d6b3dc4e10f
  • SHA512 f4b146247ba95f4ef69c97bb84482659ced6114129a88749a46f441b999593cf70029bf9cb7629a75f7df3b2b31d33d211774dda4cf644b23a26f6cb857c9424
  • SSDEEP 98304:n2gtqICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXH3AMFM6gRK:jqICteErownP0oTcMsABqlNRgg
  • TLSH
    T1D6463348B3E809E1E9B3D13D85665621E573B4254BB0D1CF03AC9B261F676E0AF3EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2