Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 03:06
General
-
Target
84b76ead800289bda9f0961e36fa97ebaadffd833de58c9eab75e6c99efb4f0eN.exe
-
Size
29KB
-
MD5
affadffd358835f7ba4dae8d953954b0
-
SHA1
ba3137565c767e9aa7f88f56a8a25e6697daa5fe
-
SHA256
84b76ead800289bda9f0961e36fa97ebaadffd833de58c9eab75e6c99efb4f0e
-
SHA512
dcbf341834086f16acf81c9778aeb9a66ab3f3dee57d7e07a0457a01a04664ddf9cae290e173f18f38bd3772d6bb22f8033bd334c38286cb68877289e43b2a7e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/o:AEwVs+0jNDY1qi/qw
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84b76ead800289bda9f0961e36fa97ebaadffd833de58c9eab75e6c99efb4f0eN.exe"C:\Users\Admin\AppData\Local\Temp\84b76ead800289bda9f0961e36fa97ebaadffd833de58c9eab75e6c99efb4f0eN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5d84967e6b24a9fd3755a5acb54be05cd
SHA10b3c5e7fbb2529a09ddd8914e30426f49bc07148
SHA256dfd8cef6102eb3b5692df6f755b0e4041601d5e780aa76f1673413ec3f7a501b
SHA512c52716bc66fe1e7626cfa2fd259d3d617a790495d8114cb8548aa9a303bbba42b62eeaf5fdec6769d2a86a4ca720f49b52570a4d43ca99717bdebb047bfe0f9a
-
Filesize
320B
MD5ad6e424cf186ee0d9d983321cc2c985b
SHA110de833fa7abf426a9fb657cf77cc2e83f3a6852
SHA25683423d26556a7826c45edea7692e23eeaadd9a0bff3267a8a1e0ab87eb521e8d
SHA512aac381c6bb26f5c31713b4142b823e2c626af66520bb7311e9b1940e0d625deed06041a905f5edc0c13de969462fe4ab6f83d932269ec8840b1ee3d51c40e069
-
Filesize
320B
MD5d07b9b85d0c6cb63fc449196b11ba4bc
SHA14c04932caa79b7200dc4ab133f58ed291139202a
SHA256e7620efb9bcbc5636269810605487b097ee5b5ead32c25e433de1613f7107270
SHA5120e81b7405ab47019b4ae989eaf619541c1bba6e76a117dc1170b7b52c2bfbb05b33d74d14c325a14f4610f4a519109ebabeb992314bb256d4493d15c110c5702
-
Filesize
320B
MD5a3743aabac312e6ac3a790172f7a521a
SHA1a285eb8ae33f3f15f6acca47eeb059606e12a150
SHA25652db337f6baabf28639086f00b0f34dfd0b8c3d0b1021edf1890d740341aabd9
SHA5129a66bbf66279955dfd1f711097f0b17688492d17ba49a1d36277e1e76ccb73d7246b34882d8fe4c5f7421a6b89d899c8f7f670e2054abcdd3bb91cee2e1c8502
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB