Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    d2dc13559d808a0f97814cffa111a05a12a53915f879efeda02314a94ccff164.exe
  • Size 5.4MB
  • SHA256 d2dc13559d808a0f97814cffa111a05a12a53915f879efeda02314a94ccff164
  • MD5 3901cb3828418b26d31ac407f22fcf77
  • SHA1 4e967ea6a677bcecec9e46004d68d2d78ff9dd5f
  • SHA512 e12198515f62ca2ee1fd4079f0cb4ce29b20f8157dc1e63de242d1208ce37ad46a83661d7b25a7fab3c77c4562f7e6e42fd85fa6b695f5edeacdc3c2f07138b5
  • SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRD:OrICteErownP0oTcMsABqlaOzR
  • TLSH
    T1B5463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2