Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-12-2024 00:02
General
-
Target
c1f9f9af3482008484f2bb7aeaa9eb6ad06ddbddb705490c37dc4e79b404f668N.exe
-
Size
29KB
-
MD5
63d819632521101c4050b58267868430
-
SHA1
b04a83269382af878f265a779ced69070508816f
-
SHA256
c1f9f9af3482008484f2bb7aeaa9eb6ad06ddbddb705490c37dc4e79b404f668
-
SHA512
e0bc83f9e925b0458cb4fb609ff1a822bf86de6f4a5e839ef93fa1f02f6630046c5b8389a24eb6b5c7ebd97a1f446f021d753f6559a3b36163f58cb442bf2813
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/K:AEwVs+0jNDY1qi/qi
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1f9f9af3482008484f2bb7aeaa9eb6ad06ddbddb705490c37dc4e79b404f668N.exe"C:\Users\Admin\AppData\Local\Temp\c1f9f9af3482008484f2bb7aeaa9eb6ad06ddbddb705490c37dc4e79b404f668N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5c6dae4fcf7ba9f1efc60a303a0e43d6b
SHA1b9791d85bb8d222439a2f595d8b615d801f72133
SHA256adf0d737928d0e1b5e71319a9a02e572037ea6e500b64a10930076be5567650f
SHA51276e04ba743ec7db02550c1ee6a9b56de7ae5df3da04b463deb29e3ac767e5f92275a3460989175009cf52ea8a922c8f76303866d8cc7f1a56b11dad5d62cf240
-
Filesize
352B
MD58b6b0d04cb29a0cc7ba8a30f0a58a3db
SHA18b3a6f5bd52dda5d0caead7ebe6daa7fd24afd38
SHA256296d5d8811f16fb4d550745e0c2bb604bae2e131c4cde9c1ca09dc810337a881
SHA5129da70d6ad7a99792b267904d52d76dc30aa67b6da0d4f0a858f4a9e985f1c1d18d2373442672cf57f792217d168a03af26624d5aa6d3f31768bb5739fa709c78
-
Filesize
352B
MD5ec3b84c02bba2f66a69fb2164b6f6667
SHA13e86fb21277c30a2ece075d2ae05a8139e6d858a
SHA256338f02f046cbb80948fb733d09035e328410e655e8107d10fa6e7209a7b8a015
SHA5120c73f641764bf96a3ac8b9096879f01c12f2c82d0b1da56ad670d8ad835f2c581674a67fd99d16aed95094205d24c9f02fc9998c7c471d78f261a1cb8b3d36fc
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB