Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-11-2024 19:15
General
-
Target
046b0a762bc8daef7554fccfd5a4c449ae413db3af6f2592c32cf4fbaa660fa8.exe
-
Size
41KB
-
MD5
fe54fe643e417a834e0402be92bdab45
-
SHA1
953ceeceb59e6d0489bcba9f58156b7cbfa14edf
-
SHA256
046b0a762bc8daef7554fccfd5a4c449ae413db3af6f2592c32cf4fbaa660fa8
-
SHA512
82d46f4faebce68353db164cbb3f26005c28603f806cd54533719b3819950677ce56a218cee0888ae19a6fb085b6cb2bcf2740e97333c0de9fd2b62468c3ec0e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\046b0a762bc8daef7554fccfd5a4c449ae413db3af6f2592c32cf4fbaa660fa8.exe"C:\Users\Admin\AppData\Local\Temp\046b0a762bc8daef7554fccfd5a4c449ae413db3af6f2592c32cf4fbaa660fa8.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD5bb53ead3d9244ae528a961f7c21fa88f
SHA1cf333c7528b1c0e1d6d1a90dacfd067b6fcdad53
SHA2567bcedcc520e753227866583938e131c0c7958178f70bc8b15623ad9040c5a272
SHA5129a119d8ff4f7d55c0ea96b84ecd5789b8c10fe8788525745b40db1b057a2cc5fee3832d97259ee90fbb519a1aa735c63cb4ff1af7b911c49ad5e1591cea8e80a
-
Filesize
41KB
MD5d197aa32414390b5a6d4dd609f7f39e3
SHA1ba1e63cd647a65c3928edd282515812a56d19970
SHA256c05945d61dd553d459afb1cbdf319630d0d839e34d793b40f24e20ea82cfbf10
SHA51226470ab905eb09efb34883c3244e4b5cf3b144fc4c2bb9dd0d702faf5232e52d5cc3637ba644bf1381d12bcf4b5aec970617b15fe1a4220ad0fd7790ad641171
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
160B
MD599ef462d76e42a78c6f00e7427807f18
SHA1e820e7ba5f696e807e223aa03f1c9e750c4ee473
SHA256b00c9dc933963387c93e3a002c68bb4a85e9f48d6e34974b33d1351a76f3a2f3
SHA5126532a9cbd3c5e0d05e4986a3a34ece452b0affaf112b2e740b45643c5fc04cb3f43a1171f1d6ef9f89dbe56f09c97bc9d0225adc0b2111ea90c25aa8e02a5879
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB