Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 00:05
General
-
Target
74ccc9221e32fad4db75c4c05adf6d1fabbcaeb71260e77cc40c0cbe6e961119.exe
-
Size
41KB
-
MD5
4c02eb6fc4b0615be76ef8bac9e277fc
-
SHA1
d6cb098207354d58ce82fda435f41382701aa3c6
-
SHA256
74ccc9221e32fad4db75c4c05adf6d1fabbcaeb71260e77cc40c0cbe6e961119
-
SHA512
1f9eabb08acaab5a35755d734fc36ea3769ca98523955780c8b8ade3f0bfb4a2cbd8aab02fb4200df25ba899343953c378930bc928cbe6b509368cb89b61c26b
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74ccc9221e32fad4db75c4c05adf6d1fabbcaeb71260e77cc40c0cbe6e961119.exe"C:\Users\Admin\AppData\Local\Temp\74ccc9221e32fad4db75c4c05adf6d1fabbcaeb71260e77cc40c0cbe6e961119.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
41KB
MD51c279a2563cbdd880b168668e0f15b86
SHA10a4e79af998c1a57395fa7e25771877f1ac9fe3a
SHA256bfb0486441cf8479ed883259907600039fa1a49b3f065e3ca358016b4bc87981
SHA5122493fef44323ec0e177c262a63a2734b1fe58bab58110a40ca63589297f479b56dbc70c6a19f8d2928a0e1a6e45308db9bb4e153c440f5aa1da0499223ac389a
-
Filesize
192B
MD53a76f113a94627d6dcbd2e50a19fa82d
SHA17e51730915cf4eaa6a1f420017e61ea3b31a782a
SHA256e8f31612889811ea8ad4fe09ee5ec8bc5dcdd692fe26ec4bce4500c2da8116a5
SHA51216a9ea2dee32dbb523e8844f1bc61989ba7932bb0ef782f62ba6a585eb92fa2ed5026a2fa34ae2fd6f38cbd7fd1aa8e999dff3b887e0dbcb8bbd09db080658db
-
Filesize
192B
MD518b381f673e4724c9e1f1e748167c62e
SHA1dc9de93f2f2e22283627115a027142b324a0263e
SHA256b8f04064ba1e97e8340c48854e07786b4fcea9b1fd08dc1057d3fa7c77582ed4
SHA512a51741754cd95cd5a04f1c5657a5107c06f8d7e9829a4d129aa1da0e4b7eb58b30422acc7689bb7e61c96877db0f66144e518606ff784ebc1042f3bb333daadc
-
Filesize
192B
MD580c06143672ddf3b7d61e4c0ff3abc35
SHA1f88c0931d9a7432933aa5b6d9ed47fc33926edb7
SHA2560254ad7b8ac1052d282ae64897ac0e90133bb0818dfdeedad4bb44e981885dee
SHA51233e09d45406bbbd01e33745047508ebb7f10d1310f8573a629bac996fa0864e3c52452d03a4e5535344975a78689c8c8c9daf03f22e9ad0315b0c976abb84202
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB