Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
02-10-2024 01:15
General
-
Target
b95ac42c23e8e11a348f9fd798aa8aa750552c3578813950bab64f0fe7063e99N.exe
-
Size
29KB
-
MD5
1e94fcb1a11fc3550aa097ab00c38a50
-
SHA1
f2ec31728d0f4abb4a22667d24eac7e93a6f10b4
-
SHA256
b95ac42c23e8e11a348f9fd798aa8aa750552c3578813950bab64f0fe7063e99
-
SHA512
b3499b5f919b122c87c5f8819b0c6b4717fd06652727ec57190b4de63a09b07cc20abc7992aba274bdc0408f23f04ceb1287458faaaeba1cff3f06de9c06ef73
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/pJ:AEwVs+0jNDY1qi/qX
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b95ac42c23e8e11a348f9fd798aa8aa750552c3578813950bab64f0fe7063e99N.exe"C:\Users\Admin\AppData\Local\Temp\b95ac42c23e8e11a348f9fd798aa8aa750552c3578813950bab64f0fe7063e99N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5dff3d2b8b5399b191f6a3fde14fd7b63
SHA13965ccbf84378e53321f55d2cc4550b38b35c2ca
SHA25626e2b10a8dfbfa285996ee5e871735e024f72b7a1fee464b4e39349acc9bc607
SHA51285b81e0bcac01d3935475fffcc1e9b490058fe7a8051050af3b39cf760029b6674f8a7e6fe653e25e1cac77ef1c8698ccd4e32b19adff041db5622cfc29b2802
-
Filesize
29KB
MD589b992cecf161d7d259639177f68a333
SHA1873cff607622ca71d24a4805ddfd26a1037ee7fd
SHA2561cd4235b9dc73f1a07918c3246e2f3cfdc7ef16a7f00bc6d10e03005328d2ba4
SHA51235cdece9a52109291c9fe773a13118437f53f58bbca1441504c3b43dcffb5e9627c449e31488a8df2a1adc00a204644e82fa015c12c8230052605bf8dbba44e6
-
Filesize
352B
MD50c4af98718f213a3d0e0348868caf000
SHA1134f4b096339d4d646258107b4ad8ef864769d48
SHA2568e658a817fcd15584d7188f05f022fae1667a112c9a2c83c56f9979f2bfacde8
SHA512dbd66d82e4321bbf5dd94092a1c0e43e6754e8f01c92b12f4ca3400419dcba3c25692222e3342cbdf4ce93c16d222123941e824d61119286cddb4771485e221d
-
Filesize
352B
MD596a1ef65c7c9378eee9d7a219c00cda9
SHA1fcce42825eba27ae110e7dec239b77ce6d969be0
SHA256cfc81d1f27f8bb4e9c9335420442992e3795e8ffb5587b78189e620984601c2d
SHA51224a0aaef753c6000e4133ade2570e94d07d8be87ed27f445b9d37259303a0625e7d7fa2d70a64a03d510c376cbec86733b936f0b3919d62323cb465196044b3a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB