Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/10/2024, 17:19
General
-
Target
e3b28efe92b38345eee7edf78b57a009e1861379a1c6b16a2c0d57dcb0c0efdcN.exe
-
Size
29KB
-
MD5
b24bd6b387e61dd8436f1905e27a08b0
-
SHA1
880b0289b3d2af117f2faa8009762d54abe819ba
-
SHA256
e3b28efe92b38345eee7edf78b57a009e1861379a1c6b16a2c0d57dcb0c0efdc
-
SHA512
06e44a942687421b1c78a15fddfc85771e430bd935af97b8ec64ceac042a5fc3e274c6ba197d42f2d3380c6c6ac03c9422f936f103a0e05fad2a99e763e9aa6e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//Y:AEwVs+0jNDY1qi/qI
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3b28efe92b38345eee7edf78b57a009e1861379a1c6b16a2c0d57dcb0c0efdcN.exe"C:\Users\Admin\AppData\Local\Temp\e3b28efe92b38345eee7edf78b57a009e1861379a1c6b16a2c0d57dcb0c0efdcN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD572c757de1749db59a9bbbf40dbd1e24d
SHA1043ffbfbf843e0eb05633f7c67f7aef1ea59a7c7
SHA256d9afbcbf1add75701141777f2f25d10b051915455f18a3108aef4770847e726c
SHA51211bbb9fed182576547c45c5afe78ef302db63b053f49fe2aeddc851e1746a5964fbda1ff83c773a93638dbd6cecbd9e3a2bd5662f4ddeb0ff0f398623f241d02
-
Filesize
256B
MD513d828987382c8d1c0db550afb9c5933
SHA182811d91b5d28c11fcd74f09d6c6b01079079e30
SHA256a805990f084bd0e060077793bca41ca3e6ad15650d010245dd55fa06b524ec14
SHA512ad8cc159f926a90db6b534e7a0ee510edbb1054d5db03e15144e9004f1a632d73f95c43069c91ab967f5f3ed6d5d0679b28f68815abe8108e82dff8d30bbebb6
-
Filesize
288B
MD51516d5c4a57314cdc42bf3a498fb3b1a
SHA13f399aa1d42c747fa12a34a25e26ed4c65265208
SHA256c940acd947a63ed0e32f7ac9252801837ea34ac7a8c9605082907d089e06da78
SHA51297cdc78677f7bba088a7ac968ffe4331e6b261e9e5a685ad5d640a9a3402343ec37a368e30aac89d9000144f5fcb2d6fc76df2574b1ff8ffa0730ec768349bba
-
Filesize
288B
MD5616beadfb2ec12b8cf6f52b6848c31f6
SHA15a195ff4c6ead52ced93b4f8b814413ba4b5793f
SHA25690ff51afc17ec207ca93a11c0559ad07769e2f3383a702adca1672f1dfd18342
SHA51295c28ff69733ae13d3aa28fb0dfe4a994f0cfb65352873cab3f52efd26d3b2b0f186433c247525a08065955e3d15f86087e03b2e306018f9cb20fefcd2b2754f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB