Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 08:45
General
-
Target
ad1ced99e5f931cdad70cd5d71706fccfe17255ef7a8123e9223466a5a9bf9b5.exe
-
Size
29KB
-
MD5
18fd91894b0a6ab4dbe3703bfe72deaf
-
SHA1
d3786f114dfc511544b6b7b3411b9d9a5fc29080
-
SHA256
ad1ced99e5f931cdad70cd5d71706fccfe17255ef7a8123e9223466a5a9bf9b5
-
SHA512
4a95db7f406c298f922961663733106788cdba37430ca3e252bfbed63ff9fea85ead5c67e1ff84fd98ba47d8ed025413b8553437e7e050323a1230c66e000186
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/6:AEwVs+0jNDY1qi/qS
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1ced99e5f931cdad70cd5d71706fccfe17255ef7a8123e9223466a5a9bf9b5.exe"C:\Users\Admin\AppData\Local\Temp\ad1ced99e5f931cdad70cd5d71706fccfe17255ef7a8123e9223466a5a9bf9b5.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5870dfc2a01de19053dda1e6bf59cc12e
SHA18a35f955b78fe237a5dcaf67e60b787892b9c873
SHA25666040e5753b9883cff151ddd5e409bdc6e516ec8bc72c998ae3c17d90a3a48d5
SHA512af80c3ba6caa40febc33265067763a95560dab4bf45ee3a0784753c303c82eda0789bd6fc33233fd17bb2b3ad5e199fa27f38bbf0a27c68bba8fe6fcc77c1965
-
Filesize
352B
MD53528c5b04b573628b776f909c6234664
SHA180926761cd4c01e54c3e08b95fd2cfdf2fdcaf48
SHA2568340b333fa90d5fbddc21088e4f3f144e2fc63097b6aaa157dc2ba50605f2318
SHA5120bc45af173dfd32d93427b9fb0c9f13281277f0273b4d4af93d9c8c8fba0150ffa5ef77274630f598109924646fddfb500e6e86f5416f4faba16311102218e48
-
Filesize
352B
MD5d789766726cba18a51c536b01987be9d
SHA1c287cfbce19e00d12dc7264397d23c2b014330a5
SHA25622596cdd790f9d82c04c8e70ae7f7b6d58abeec6a44c033756f2ab668d8b0f5a
SHA512f5934895303f20c9b1449886aed8d571bbe1b093ae433e6819bf580972c84d3543b21a4bbf3dc3b499f4e9b14281ed50ddc42550f9c9c52822750970032a857d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB