Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 19:44
General
-
Target
fd4e75dc6347ea76a7a456e9a02e7fbd258e84f6161f8f4f2e1cff027179327f.exe
-
Size
29KB
-
MD5
f6699ae4df394022be40ca7b5f5db8cf
-
SHA1
6f1db70d15d43adea397dc71fc14594b2e227e6d
-
SHA256
fd4e75dc6347ea76a7a456e9a02e7fbd258e84f6161f8f4f2e1cff027179327f
-
SHA512
c2ecbed7fc471f7fcff1659f003025642e4336566c94bc37ba7c670758db642fe5b368575ad3429ca2deea1495277b2ddb52aa12efc4a1ec798d9650b8129199
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/V3t:AEwVs+0jNDY1qi/qL
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd4e75dc6347ea76a7a456e9a02e7fbd258e84f6161f8f4f2e1cff027179327f.exe"C:\Users\Admin\AppData\Local\Temp\fd4e75dc6347ea76a7a456e9a02e7fbd258e84f6161f8f4f2e1cff027179327f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5d5cc26604df6b28e5dd1ca341cf3e379
SHA10e86561d1be1efad6277da962a017209d19b9012
SHA2560c268de46a00959b379fe7c462b711d0676e2dd0884f9424bf6e3111c01239e0
SHA5120d4cb71e1468737af903aecf1f23466afae6dc86a2bb8eb5c94a4676ac9c0a30dfb17a8defec6f3850cda0eb84658e06360763a9681c8d98bc4ffe046d49c786
-
Filesize
352B
MD541adca8c8354f6a99a13bb22cdf69493
SHA130ae7e36f1d158efadaa0c193f8a4d336dbe50fa
SHA2561c2e6e29b911fd4a539e8f9982f0aab98bc0f3150e7e073ba9612c6a3ceb9cbf
SHA51269e54d96fa82952a36013f296076cba64a22500f461b48d50bc5d1033a5717be670b31888cc06cc7bafe28f83afadf6016f71198b89197b99c9c7bffb08eeb70
-
Filesize
352B
MD5c239d8862dd9c3a41a40f339db420008
SHA187eff611cc22783e85f6d8586ef234c217219088
SHA2567f05ab2666c653e234539aa559d24aa516ed35025cf5b738ea12f419b66bd1c6
SHA512253d5d142be47f6f4d3915db98efc32a66b3de80730bd28352f16b2b0cea623ae2f21c4e7708c28b3f5dbbb523d9a1088a791667ce86c693920c2c282e2731dd
-
Filesize
352B
MD513c721d29e0ee667f089bec135d93cf4
SHA1ad16c64b54473083f07d5a14ee5356ef25e9d8e5
SHA2566424e9a3b435109a56eb9d82bfd3d4ffb77e8e398c76c76059cf5d2fcd67a3ca
SHA512fb745b276d0c883aa290c940b93371eceb702ff12da5215d0e1c15413c6c0b9a220caef5bfb8d91968ccccef5b74066209b7bf0915a87aef16b28ba95a21620e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB