Extracted

• • Target
    2f199573ab0d2f34f877614235528647649de02b89e46fa540884080494e9bff.exe
  • Size 5.4MB
  • SHA256 2f199573ab0d2f34f877614235528647649de02b89e46fa540884080494e9bff
  • MD5 92f614a9cddb8934bb436bcf667c7f3a
  • SHA1 8b46fbad97dc17cdda0ca725e0e20e7ed2b8a09d
  • SHA512 2897ac2f1e8c55ff07c40270bce4276e8eea22e1285ed91cce63844633e0223474aeb8b897587e4be1ef8fe793175bc982484e664a2e52cc86fe2757b854d748
  • SSDEEP 98304:n2gtqICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXH3AMFM6gRZ:jqICteErownP0oTcMsABqlNRg7
  • TLSH
    T157463348B3A809E1FAB3D13D85665621E573B4254BF0D1CF03AC9A261F676E0AF3E750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2