Extracted

• • Target
    399895736f31a42d5ef5d650bec03145b4a47dad8aae99b210694b18c5217f6b.exe
  • Size 5.4MB
  • SHA256 399895736f31a42d5ef5d650bec03145b4a47dad8aae99b210694b18c5217f6b
  • MD5 546eec93a384847f243c631d3a2eb476
  • SHA1 37a01a64730dbb5d15e921844d261a1a93a745a0
  • SHA512 2aabfb4f97930607df36f1bc0fdd9f7c2967c82b7b3b6fabd802fbfcfab7c8b38e8c73cc779496f7f4f8d868d7ca423de766599ecf6a4900fff8866f68b13504
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMU:9XhICteErownP0oTcMsABqlDQkf
  • TLSH
    T197463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2