Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 05:04
General
-
Target
9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
-
Size
41KB
-
MD5
be3341e79b2f12499de7c15ca4ec94a7
-
SHA1
f776f7211c191ea6e0a94f01a41009bf4e62506c
-
SHA256
9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805
-
SHA512
68bfd6a214dc0a52cbf422c59652992190046d1db5c1f79462fae12b9b72e96dbbb63f69953a0c3ed290e15426f1447ccf2d5e1dac72b9a2b749a142b9de837a
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/M:AEwVs+0jNDY1qi/qE
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe"C:\Users\Admin\AppData\Local\Temp\9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD5366329e0356f132f4c0060680434c4ef
SHA1abfb460515556994e099fbea7fbbb5f544b4b9a6
SHA25637d2392532bfdcb05f644adc2ce5b9ddc5ea83744b7234b7478e9065647933e8
SHA512537b6e310c1549af279b753cfcae079af5f0bc239309dc60c200c295ec00c3f7d9010a7cb8fb8da94f03bf091fb26972924dccdf8649d474f9c49113f7019341
-
Filesize
41KB
MD515ca50ec1624b0688f0ed0ee8aa4753e
SHA138c8220954177103f327d17c8755599ceb6e97a4
SHA2561c4aab754b3e85361cd041643c416045db7a712ffdfea73b1a81b460faa7c7ce
SHA5127ed620af51fc40d72ae7d4fa531a02a9d961f6753fe490300fe70f33f88704885925e5d43f93e8f3eb1e47c3b7448939c0ec36cc7dbf4897bdf27ceb8ace453b
-
Filesize
160B
MD55a370871a60d346933ba814df7d9c961
SHA1b6ff028b9b672e29ab19e5f70defbcbaab789326
SHA256c0cbbb8de9aa43b867c4424ef69d45902a90e4ceeea1ab4b9b9cfbb7a441aa30
SHA51279914973fd6c865b18bd2b91d5abe938b954b27c9cff2317233cf15a7ebffba33f363c673a130ad984d5811a410d307accde7079624ec0ad16d29132f9ad9497
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB