Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    ca57181f10d00a3537ed85d1462880825239bf6129a7c51ef0f0963d4fbc0a5b.exe
  • Size 5.4MB
  • SHA256 ca57181f10d00a3537ed85d1462880825239bf6129a7c51ef0f0963d4fbc0a5b
  • MD5 057612d5090bb8fe3b92f4a98f376c01
  • SHA1 2ca197dfdb28062370ad247ae6d5317a0a707f2a
  • SHA512 5c7e21a17415a47438e4488818ffe67475439518461cdee4232ea3def5a4dfdc9ab35c7f7443ae86fc2c39049071b38979d8907ec770a495d2472d8d965fe8d7
  • SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6ut:AsTICteErownP0oTcMsABqljks
  • TLSH
    T1B5463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2