Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 05:00
General
-
Target
e28d6be8f6a7c9b7a9efbd07d03fec02fd275dbe627a3ea680e0201bd7340878.exe
-
Size
41KB
-
MD5
543db4614f05750a0a2a544d330cd116
-
SHA1
8a607beee99fe2c9c8fc2cc25d6576c9e92081c7
-
SHA256
e28d6be8f6a7c9b7a9efbd07d03fec02fd275dbe627a3ea680e0201bd7340878
-
SHA512
c9f81dec1097baf3c8748fecb2253addfc0c4762a58ce8d1f8e9ae8380525f5bc1f384b1a7fa02cd593cfbf634b44850a651ae585e59110dfc9f96c866f670cf
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e28d6be8f6a7c9b7a9efbd07d03fec02fd275dbe627a3ea680e0201bd7340878.exe"C:\Users\Admin\AppData\Local\Temp\e28d6be8f6a7c9b7a9efbd07d03fec02fd275dbe627a3ea680e0201bd7340878.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
41KB
MD54ce7a7077cf626e0b29ba56c1fed27cb
SHA1486179e3e57460e5d737efd1f44230803e157296
SHA2561396605211a29c17ed5b13eec3c3f4f70bcad3cbc8df204343b357be7e8c0f61
SHA512b9ed92910b996d1dad3b24722a2c84bac4982a15dcb2714289201b054054f851d5ff7ac14ac67cb0a479cb7731cb48b68f1f7499de2fe363ce9a4d83330d3831
-
Filesize
192B
MD55cd8c9452c3b373eaf1177ecca460dd0
SHA1461cc21c7d569e1fd5760f553aead65e848679d9
SHA256d65482880fed273c41793de9d5c45c69ab74999a004727f88b98311d742c6e69
SHA512a74fb740f789aecbfec1b5aea4369a7ea48c33f11ced8f522de7342d3b6aa16ca332a44f61cc8c2ee57068555327b271928480aeacd7124accd6a6dbb383ea3b
-
Filesize
192B
MD5fa6cb31b5d67de278c7989d17bff2623
SHA1ddb7c9251fd020b5480321f530adc913513f7975
SHA2566448618d475225af48e574d5147a7c4fcdbb8e4f26d6c0318009499b75fb9a73
SHA512a322977204d60408f4fa6ac245ad95b8e3b47a8937742e5c201bc4a05a1170f34cd47566c82c4b1a3a679f7ddac60939ee757852ceb37ff309502486b20e160d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB