Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-11-2024 19:51
General
-
Target
11185c2bc3871cabdf8c2f2e5724fed8fb864ee449ae6b44bc0c0d59e8d1b3c6.exe
-
Size
29KB
-
MD5
e1353f98523d2401b2dade44688d4182
-
SHA1
6b759ca6f879e892acafd4742718c6d94a3b8130
-
SHA256
11185c2bc3871cabdf8c2f2e5724fed8fb864ee449ae6b44bc0c0d59e8d1b3c6
-
SHA512
bc0aae6b99c7f47d0784975332fdee55c3d48f314e9499740a3da07a2ab1dcd8b360902ca380ae72909f9107d6a3ea42868459aa7857f2d79c4e0aba09507066
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/PU:AEwVs+0jNDY1qi/qnU
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11185c2bc3871cabdf8c2f2e5724fed8fb864ee449ae6b44bc0c0d59e8d1b3c6.exe"C:\Users\Admin\AppData\Local\Temp\11185c2bc3871cabdf8c2f2e5724fed8fb864ee449ae6b44bc0c0d59e8d1b3c6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5c2c91b33e3342f4da35d2cd71ae5bd34
SHA14ccaa45ef5c7ce38603fbcc156d79d791ab7f5a4
SHA256a6e0b3d6a781c7ca2cee4e5eb2308cebe32a4c477e405fef8720631955a2d170
SHA5123d7e0b930331ad50065a89fe520b5d949bf3f2efd7db9171d0d76ad59197d69edda99b0aadc1b46dc06bb21ab30bee7e5ad02afcadf47cb17653d5709863457d
-
Filesize
299B
MD53fa24bbf18047a49945d49b566045f01
SHA17bf431326e4ffebf91dda62c07f286e734592e66
SHA256d40582bbecb8cc90cdd0d58d6629f76c84cfcb264c00933569a1b6cad0de23a2
SHA512b06c710b18fb74690a89b38490a64867e82878d274af49b037408928298382435deca46a7ea8df25b4cb6bce3f446c86d5d4ee07bbee7508afea9fa0e2bb9cfc
-
Filesize
320B
MD5e05bbbba616d3efcb98fd7af7c84bf10
SHA1e0ac7ad3a72295a45ce366b4a66778b1729693ea
SHA2566e39c970e505347d2f3f74c913766a22a715f0ec2843ce9e7664399c1d3c9c78
SHA512c5fc749dc20c6a3efd2f49a78d0cd9ee4c092120f900aa84c5b0a8df108f0b4e31de0d90e91c37a80af0c17b3775a10d06cd5859c5e3332bf9bc183a3f422564
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB