Extracted

• • Target
    3bb39a965451ba95629c537f48d00788129f526b4a4ce1e23c41dd8c5b6e039d.exe
  • Size 5.4MB
  • SHA256 3bb39a965451ba95629c537f48d00788129f526b4a4ce1e23c41dd8c5b6e039d
  • MD5 814acba7c8302b4407d350b30ee17c63
  • SHA1 ecb8cbade6fea337764fc4d0d5d9d1c4a2ba4236
  • SHA512 b8992ece6de221ed10243abc34411357ba5100fe1ec4a7831119b2eaf5e36b7309ee81b07b8c29fb59644571ffc037cf857d3bcebd2ce6788d4d306426a0f93d
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMi:9XhICteErownP0oTcMsABqlDQkp
  • TLSH
    T143463308B3A80DE1F9B3D13981665621D473B4254BB0D1CF43AC9A662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2