Extracted

Extracted

• • Target
    X Ray Dental Panoramic CBCT 3D Records F11k8.bat
  • Size 3.7MB
  • SHA256 1d990af52165098db17b709148aed2a3793962f5f7074ee6ce63e181002981df
  • MD5 38289a787e92f954653c1fbe7268c128
  • SHA1 1e48bdd7434aad3ef94d814b62ce960b47d58e18
  • SHA512 291e0c1c0ffbbc4825a5101b9020b6af53bdd3d746a53038a158834dbe2fed3f8f4ef1ed0e0aaa2c66a8aa1ee6166d3ea554161ac0dab6b2b4913efb0ed7fd34
  • SSDEEP 3072:HYi0MMquW/wOzww4OubAi6+ufYfSBeRNewSPdOCjED4HnMfuHXhVlOMtx6n5nlEY:U
  • TLSH
    T1B8063C54D3ED1F8FB0E3C618A0474E235DCBB63D176BD801AA6C7B3E86E151E8865872
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2