Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 07:18
General
-
Target
0d4966093a352912aea455b9a0f94ec3354c77bec72021c8deafd16b34eb96dbN.exe
-
Size
29KB
-
MD5
4ea198400556066bb9c1e837da92ea40
-
SHA1
25967ed74974600853b2be533e2449a8501d4ad9
-
SHA256
0d4966093a352912aea455b9a0f94ec3354c77bec72021c8deafd16b34eb96db
-
SHA512
0442a3f8ffc3ba0235aa01f7ccb22e2b05108a3db22710d98e48a9765372dc77d8f26d529978713b4c104ad630e27a26f3a5092cf9232b9a4051477258f12c62
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/u4:AEwVs+0jNDY1qi/qm4
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4966093a352912aea455b9a0f94ec3354c77bec72021c8deafd16b34eb96dbN.exe"C:\Users\Admin\AppData\Local\Temp\0d4966093a352912aea455b9a0f94ec3354c77bec72021c8deafd16b34eb96dbN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5d521971c26f50b88ccfd0a27521f3ece
SHA1e41446820324c08dd7f3ae95386b14a9832136f7
SHA256581bd557056d78636bb53e66c74668dcf9049f4e8c7e9a2ab72b67de1b875db4
SHA51229f4c66da5be8f8c75cfb33d3d11b1026d9ace754ac3e528b55fdf26aeb6654eeaeb858afa1a675458de35f4a0cf2c546aa270382524fd5f18ebc6acc33bfba2
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD56a0cf88f18a8fb0b48c866658f93defb
SHA1eee68ff668a2ed3283e93ddfca40065d7f77c1fb
SHA256e0b373c1e8e0eb43f224b80e4a550630172294ccabc4f112c058d85504ea9e17
SHA512a754c0d32164ef8dccc2baa6cb9613e1b320402e0ba6376ec89797fea5cd9be403e268be7284b99f300b208082a7245c6dabcd1d8a94cdba4fa33db11564d086
-
Filesize
320B
MD580ba4ad277edbb1b97648406d5ec252c
SHA1d724e905bf887a183b12b70299e2a07a95b678dc
SHA2566cd585a4a3993d81c94a3bf6956d5a911377b8e0633578bb0b98c399452d3688
SHA512bdefa82b554307fc4641809ee4ec6083dfba4770b1c4b95d8d8e45a5045dcbb0d4800eb841fdbc9951fb831262d15e87abcd72c970d7871ebd61274747d4d9ba
-
Filesize
320B
MD5641d20cf9477defb9ce6a2347ab8f3c2
SHA17b62b43a884dd6a89466d41ff07d9c1fb77f453d
SHA2568b90fac86d00606c62a0e6a7a863e64b9c994216bf7c75129c1aefb806a751af
SHA5126577dac0deb79f232af4468e5e393b35030e933789215ef5b5e028de406fabef41617519b0576c826ac41d3e17e5a8c0791dd0bd13b3e97e10b4597c19739948
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB