Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-11-2024 18:40
General
-
Target
8bf116d99617cd0c3d047ff6ea7fbd654133c02bf1f11fea34159c495a6febca.exe
-
Size
29KB
-
MD5
fb25c4cf86f7122ac64ec1acab580fc7
-
SHA1
91188b7a6fe3f6f9335fef0c069efc97ef9060b0
-
SHA256
8bf116d99617cd0c3d047ff6ea7fbd654133c02bf1f11fea34159c495a6febca
-
SHA512
15225875835b25bd0267b700f8d68c9d77637a16059fb90c5f95c303f7085e5dee7cc13f236be09f1c9e3643648bab2785a6c0f5755073a7fe2366a10e082028
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/IuI:AEwVs+0jNDY1qi/qs
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bf116d99617cd0c3d047ff6ea7fbd654133c02bf1f11fea34159c495a6febca.exe"C:\Users\Admin\AppData\Local\Temp\8bf116d99617cd0c3d047ff6ea7fbd654133c02bf1f11fea34159c495a6febca.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58a6de50c3d35ca6631fc9d09689aba2e
SHA11a6cae2679b2b1202bcf35dcbe70d78b151a620d
SHA25664cc3c2036b7bd8ae6276bbd0d094a665c4562437187cdebdce6443d0386b88e
SHA51242ab0969c0982e50e8320156cb0fd37316173bbe93332b6d691bd173efe40d5869bc5556877221492da1219169e35d3315d94055feb905949d981635641d9599
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
352B
MD5feea0c970284d161f98c59d8eef4bcb5
SHA1df39c693d0c1b0d66a64973a5f83ddbc23875c94
SHA2567d21b9169646c01ab36eba51ff13b4dafe359be69cb7e5a528d9584ee251cfa8
SHA5124054ddaaf7308138d69ee2066c187c6ae9121410b563e7973e47e804f23e85a3b72698e42494e7fc8a5d25e33e19266e3d6096787ab84ef38b77a6aa73a31522
-
Filesize
352B
MD53669010177962e3b32d3d777ad5076ec
SHA103b06159b996743bcd27a9152e9a4c4cc0eb5ca2
SHA256325ece07c0fd354ad37e23266b2bd34314a0e3ed4a1ed22d60ff00645d6e6dcb
SHA51235e51fdd20897bf0da6b6252c1bfc609f80d9ea7b13b118271da222ab95495b80b593f48f52006a25e3ddc1f18cd3157175f43efe50544af89f312e074e5ce80
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB