Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-11-2024 23:36
General
-
Target
2a167513afab42f21041dd9dc552041c7bb945b16cee475d1b0f6ba029bf1d8e.exe
-
Size
29KB
-
MD5
73e90890c0ab0d3ccf224006bf1ff87d
-
SHA1
9093d8012039508ec1a39d4c543988ec9f042d99
-
SHA256
2a167513afab42f21041dd9dc552041c7bb945b16cee475d1b0f6ba029bf1d8e
-
SHA512
655c471925e6393bd05b12bcd55a53d5deda6a0f8abdc4ae57b5b172427c8faacd37bfb3ac586c5fee3789c7641827015ebb6b979db72b06155b70e5a73cfea6
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/L6:AEwVs+0jNDY1qi/qG
Malware Config
Signatures
-
Detects MyDoom family 4 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a167513afab42f21041dd9dc552041c7bb945b16cee475d1b0f6ba029bf1d8e.exe"C:\Users\Admin\AppData\Local\Temp\2a167513afab42f21041dd9dc552041c7bb945b16cee475d1b0f6ba029bf1d8e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5fc4ab4eb0a0b34f48f269a03da557dd6
SHA118b496e55be58cbeb06d1f3d98cf3dce5f055e59
SHA2560e95669934ee5cc5f42ce4690adbca523d7018361887558da12e039f98c21644
SHA51262ccc459499f79a7e495015bdebca63f2b2267773821d4d6afee61f7ef8d41cad01b140867a3230f42f31884a4149157232878ae92d8cc32af4b0ce117de363f
-
Filesize
320B
MD533f270454804e347c5454396a7ea41e5
SHA1bfe9eb41e8895f8bb8c64f17c1e7451dc14d7baa
SHA2569c242f07879f7d3844256d5fcf9240a5ce8bfd6124e2ffb80a2a5de75cffbab9
SHA5128a4e706fe071b687e4003b001fa899aa9eb8499f00593b5152782a6f788482bfebe09ddbe9e87bd275317b0b8d9a49cf7125c7ff906181591540a54b990d4567
-
Filesize
320B
MD516cfbb59f04001ec01d3aa95745e9e52
SHA105e1b5a3d01a553ba31f14d1d5ee453e24b9b021
SHA256a5097458dc6753e4ae04da94af88d8ad7b4adcf20c9382f821006985fa0d797e
SHA512338a77c3cc0e811f3baf60c4fc1fb540ff5188e5d4cfd046c88128d06254e0b6c12760baa38be366d9a63605786308b035bae91a5f902850e9bdb8b520416ae1
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB