Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 22:35
General
-
Target
46cdb81aebf6e77c3d8a9b91d2e94e4b4732047713a4f06cec840b8211dc790cN.exe
-
Size
29KB
-
MD5
1e2c686cdcc5d92333c4e18dd7b468e0
-
SHA1
525ca982a20b62aaa4336e47ead4d1f2883948ce
-
SHA256
46cdb81aebf6e77c3d8a9b91d2e94e4b4732047713a4f06cec840b8211dc790c
-
SHA512
1b5297c3b5875ac6158d0bf6d344ef6e2a9d229fe9ff8be64f0fa37106f46b0418bcf22118ccd18f80b512a48e1e2d899077c401d5ae0c3dce67a018ad436b54
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/B:AEwVs+0jNDY1qi/qp
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46cdb81aebf6e77c3d8a9b91d2e94e4b4732047713a4f06cec840b8211dc790cN.exe"C:\Users\Admin\AppData\Local\Temp\46cdb81aebf6e77c3d8a9b91d2e94e4b4732047713a4f06cec840b8211dc790cN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD599c746bd2629551b09b6c551fbe590fc
SHA1c33e27d6289ac243abd7d11b62204b4bc8e112ee
SHA2562f5a9e95713151f2fa4e1453c6afe3b9f2747d67ad44bc07cf2e019b8203a6e9
SHA5128e79d128a031d1b7aa7e6481f37a3cef9199528560cff68b5f35c53e9fa9cd958e71f5add4b1391290ead490d55584545ea3ecb0d64bccb911f27b99535856d7
-
Filesize
352B
MD5985a5f62d9acb7ff8c36e5a991361dc3
SHA162c1b588a6290d797c8aed6ca5b6061c769a0d7c
SHA256a5a809cd8a80488c97672e40e13e077b1adade3a9b26f8f40b686d2e7c0cd66d
SHA512d97c90214204db4a2a6322225cd07546797754f8fa232313d3247eac140f2fad50cea4736cda5fd003c2451b6b4fce0a0d372252d47e73ee68daba1daa441b6f
-
Filesize
352B
MD5342224e3329c5815c502553641b903ba
SHA118b1d730d1700bbda4c985926dc8566fdba7ea74
SHA256c2446d61f80a48844bc7ed3348fcf2cd3e1acb5ba0ca26fa8c8e0a21d2d29ae4
SHA5128b78ebffbbbdbdbc1378a85e45b1080a7a1a5708a344bf4c15e485ee64d60792b3480c7d025ece9fbe0e52310fd275ac41c24a575bc79e842681cd391a4b481e
-
Filesize
352B
MD5c4632a51e9f4478f7230d21954de9d69
SHA1b1f7aa25eb9d0649a4f3ff86fa86ee90fe43eccc
SHA256da7d296f5d3d659cb9f2914d7c33c1ce0a4b1f522200b6a422dcb9feb1b90d04
SHA512fc642004328b4310f57e3415a4a44c0e2788e01f51691daf8379292e64ab6e489633a114088bb2f853b32c211fd519d9926d5bac238eef682bbf799b52d7e815
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB