Extracted

• • Target
    9782eba9fe4327051d695e2c4416333e105278793bc7386d0ab6ffc772f0b5e5.exe
  • Size 5.4MB
  • SHA256 9782eba9fe4327051d695e2c4416333e105278793bc7386d0ab6ffc772f0b5e5
  • MD5 fd352a0e1e978a56575fa78701a78466
  • SHA1 9c269fc76c83407dc32c78003f9017a7fc31f831
  • SHA512 953819d6e09280e6fc261338adb8a5a84dc7b4923c08a204157060c6a9d027b2dc684f3e0de3f1210f2eec5df00835539a471e146add8fdd689d22661af751ef
  • SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUr:E+ICteErownP0oTcMsABqlUutvE
  • TLSH
    T1E8463308B3A80DE6E6B3D13D85565121E972B4254BB0D1CF03AC9A662F777E0AF3B750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2