Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 03:21
General
-
Target
d4f6ef4d96b88ff2f5d5895a97cd6ddecfcb7f73530fb9e612906af4013f6ee7.exe
-
Size
42KB
-
MD5
03454ec0a2887da44738c52261bbb88b
-
SHA1
ec54040df429096a332e89d344074601148dacb8
-
SHA256
d4f6ef4d96b88ff2f5d5895a97cd6ddecfcb7f73530fb9e612906af4013f6ee7
-
SHA512
f10ceda86be886200405f17fcab3733ea87edbc9b3d54529dc7dc824504d6df81f0c8de2b21f50e7311fce76b9b43f86abafbc2071fb4cf615209bf16726a1a1
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/R:AEwVs+0jNDY1qi/qZ
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f6ef4d96b88ff2f5d5895a97cd6ddecfcb7f73530fb9e612906af4013f6ee7.exe"C:\Users\Admin\AppData\Local\Temp\d4f6ef4d96b88ff2f5d5895a97cd6ddecfcb7f73530fb9e612906af4013f6ee7.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
128B
MD52d51f5cf1e85f357827a8d8de4280748
SHA1bdb825fdf8bcbd019133dd07f3b6ed84b622b372
SHA256a6b47499b71a3665bdd0928737e0302e2c8334972393fe4410f751b86ac749db
SHA5124235cc03a39b2e294f570bef99430ff63bfcce4a1cf57c1f22ee33c1e6116b58572b1514cd8e13358f2d9af365922297d0dc2d6d94f34eb3491da656d4f45ef9
-
Filesize
42KB
MD5dd2cbc2a20177a20f607e6768df0d539
SHA1f84ff6ed55d18fce3d7e97f080199e74284b318f
SHA256c6b8b81351bffd891989ef4b68e306b2b041841a87854059edcd1132c3093562
SHA5124f0df66b24deabef47e1f7d71ef276fc4802351ff7c9679a95b7ce7c82fd71f5e7ea99c3a7c8c9d131790d9b2b130a02c460833fbf897b9123a613ae43364bec
-
Filesize
160B
MD5f601be01c65ef798ef04ce5b9b74d4bc
SHA109dfee9696244a7a34041a08ee6bbf7d84f40697
SHA256b9af238575498cc2fa4fa46159d85c8bf1990b10eb2135885e883dce2607e23b
SHA512fe1000d9b6f81943e1fd1bc1eaa047c7850bc2b548f617fd588e9ba1ccad7ae366e7e46559158d3ab9a9b2868076aa445a48e4865eadd1480a17cd26b9784c59
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB