Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 08:53
General
-
Target
d8928158bf783fd283f738afd9c98ee82168e9e9d8c56730625894f7e8957bd6N.exe
-
Size
29KB
-
MD5
87e9f91c63b534b46fd885c56f32f7c0
-
SHA1
cc1dc0937ee10ecb1872d3122f2b3132602a9b3f
-
SHA256
d8928158bf783fd283f738afd9c98ee82168e9e9d8c56730625894f7e8957bd6
-
SHA512
64f1a43b847c06fa66213b6e3c9f17f0f3be79b80e64d9b7972f843fd79bc27adf3dc0fea44fbe8e7d1567996ba62ed01fa43fd2e24a1ad291cd78bdee6cbdb9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5e:AEwVs+0jNDY1qi/qM
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8928158bf783fd283f738afd9c98ee82168e9e9d8c56730625894f7e8957bd6N.exe"C:\Users\Admin\AppData\Local\Temp\d8928158bf783fd283f738afd9c98ee82168e9e9d8c56730625894f7e8957bd6N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5cf2f3951e1270a6cbc3ad59208e70f11
SHA14b1ec3ce9db92a49927358963bae8292d54e2c4e
SHA256e5ac52e4e2991a5736b04d31b7aeb8cc1169d49694973e05b123bbf4e1826862
SHA51229db9830a8364052df087b8f9b6acacd9d68f18cba6d4d9fee2cd26d0d1ed4606422f89770df53a8f740f1956cc2d78dd4baf56561f364db675c2ac7ab1b5efe
-
Filesize
352B
MD5da1d3d84bda84bf3fda8523afd235fd7
SHA19b405092c257bf972ac2b51a72d25b341b7dc733
SHA256bc954484e7ceefc37edf9b0b620c83e387de38505e1cd684c6de428cb23d2d63
SHA51254a3453b6ea0705195a252ce0105bce78ce5a3e079ba5e44d61e14bcf362715b3e8a11c4830d3109a070dae037f01c05569e8f5007424df0763d3236259de0a5
-
Filesize
320B
MD59ee83e376f2341f0041c215d9ff39afb
SHA1ca354400601322810716926ad96894be35721870
SHA25699d1150faa1025951c783c35c42ae166bf63ae03254581b0ca63841612c03eca
SHA512883157535ddca6fd6151ef932e2061bc4f150231df5fe9cce3dfbcaf7c7954c3d69aabd4f7e0b1e95403723535083c626ae7a07e80b9bbb56fb646ce50de1b75
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB