Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 18:33
General
-
Target
5a037dd0ad6cdfdd5bb0a52565490361bc0d4b745af4fab2887dc5322011b46aN.exe
-
Size
29KB
-
MD5
07002ba22308e07d5117f5baeafb93d0
-
SHA1
2f13cad00ea250519e2a489ba96c146735cb0f7a
-
SHA256
5a037dd0ad6cdfdd5bb0a52565490361bc0d4b745af4fab2887dc5322011b46a
-
SHA512
a1fb54ea8ac5ef9c5795ff174b68759cb081f9ba31dc65d51008a860d8e9c51541e7af1ad8dfd7f4efc360bf72ccda7834420fc14f2c0b428f1ecda386ce16bb
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ouR:AEwVs+0jNDY1qi/qN
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a037dd0ad6cdfdd5bb0a52565490361bc0d4b745af4fab2887dc5322011b46aN.exe"C:\Users\Admin\AppData\Local\Temp\5a037dd0ad6cdfdd5bb0a52565490361bc0d4b745af4fab2887dc5322011b46aN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5cad56c02ae6bf4ab730340a4d91ace71
SHA107824d5ef3b8ddc243880bc7489ef101dc8223f5
SHA256e372df9deaced7e641d14655d43a0266af696822aa0c27b173ad4d00c26dfb45
SHA512230d164dc5ab798dc3a37e96318df3f128ffdc9c5e76aaf4a7aa184829d46e10a97145e1402c43316c00284064c0e0a21712d23d282236b2dba82280ff97b6f0
-
Filesize
352B
MD561dd64ce92ef18fc4612f5d903b04eff
SHA194859ae0eaa9fa3d6184d4f3154438d2d07667cb
SHA256b8df91965bc5f87075d1acac83d052828f715fb3d6a636c1b77825c4ca1e9d88
SHA51222a360cf9f66280b657e92e1b2bc1e649d2c58e81dfcee2042ab6a405632c151ed1619a839e1c67bdc83c2979e9360ce6ab525c14e42e32e5fcbe380b5539153
-
Filesize
352B
MD59307ef546efecc2047a10abdc809a00d
SHA113ce1e033412f016c677a10ad84503581bd06571
SHA256f449b21afddfa3deed63805d249419f8d2af1a85c9a30ec1224dc7409595e229
SHA5122269a054cb18e012cfa7f786a1a87b5a263904d2d9cd105a6b3d47d2698ceace1996bbfaa58e376f6d3de5da33a541a07f3ffccf93c19a60cb30dc0815ea1f62
-
Filesize
352B
MD5b51240753827212a12f6f41a2b60b525
SHA16fda13e1acaa26142a951b89ad36e87ed87d7cc3
SHA25684a55b6c9e05abcaabedd630e24e1678a02c90b3ac2f64790eb6457af681fc00
SHA51277461aeae419f1d3e924cfc8c8d5faddee20c88471ca0fad3cf9b916bc4ebaaa389dde37c0d990b64144f08e339dabe236754a85355cc39ba7aabde3206537ef
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB