Extracted

• • Target
    4375e291beb667f6532fa9c79026753b5faf205acdc5c616295fc21d433691fd.exe
  • Size 5.4MB
  • SHA256 4375e291beb667f6532fa9c79026753b5faf205acdc5c616295fc21d433691fd
  • MD5 43a36380c91db83c7f1aa8fe9166b80d
  • SHA1 b6abd40d2d3e7fae79867ae68750a190f1b09f2e
  • SHA512 852375dfad3dc164a59a71d894e128e1d3476eb3ccc6ac18a8c5fabe9951a43401501bed02820cb35cecb432c613cca942bbd9449cbffa32b4ec9eab1eb3b457
  • SSDEEP 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61Fb:Tt7ICteErownP0oTcMsABqloOc1t
  • TLSH
    T175463308B3A80CE1FAB3E13885565621D973B42547B0D5CF43AC9A662F677E0AF3E750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2