Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 01:22
General
-
Target
9addf889786857cfd8bc3d0f0fb7338f687e42b1167629fb4774dd1b983c2995.exe
-
Size
29KB
-
MD5
9029c135166f51af2cfe68f439cd443a
-
SHA1
4d5b2a22259923aa7c4a0da4bc753e93f1d38d01
-
SHA256
9addf889786857cfd8bc3d0f0fb7338f687e42b1167629fb4774dd1b983c2995
-
SHA512
751edff3d2b8a4f2e02210c199a3573b8780b20501d9f9e5f5308b936e87225fd6e711b1b50d948b22134bbdeda368422592d2497cf9222db5cf0d438d792c5c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/lJ:AEwVs+0jNDY1qi/qz
Malware Config
Signatures
-
Detects MyDoom family 11 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9addf889786857cfd8bc3d0f0fb7338f687e42b1167629fb4774dd1b983c2995.exe"C:\Users\Admin\AppData\Local\Temp\9addf889786857cfd8bc3d0f0fb7338f687e42b1167629fb4774dd1b983c2995.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313B
MD5ffb72ab4faba49ad441ce07db37dd8b6
SHA1194e13c1c32ebb6e7a1dc912261cbd58a82ff71e
SHA2567bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
SHA512517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257
-
Filesize
313B
MD50d0d1376df3380570c4bb9c520ab38de
SHA176971247133bf210a0c5047584be0dcd0066de28
SHA25640a902c8739b322ee6619ebe215761bc432b3743f0bfc497522e581391fd506c
SHA5127b492a86e2a1209f8963c614df12a07c889ca33eddcbcd92d59258da249bcbc89d1d352e20f7772022fea597ed23a52b062d4ac6d3ec77c7c01433aed3551c7b
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
29KB
MD5ece05970cb5263c2ad06451a6dae5c4d
SHA1d4f7e111f5d04f9e606369b792c8b6d550f4fef6
SHA256c43f66d2145f526d9f0bb2e64d2869963baebe57d348610dcc3242a1202dac67
SHA5125ab43d58917be439e57a817f9ee547eec5b81f6b468f4f347fa7a28127fb799f40f581c7da357c5506843d560f1ad539b4e37d9ef42ef9f050e02ee391a9aed9
-
Filesize
384B
MD5706861aa264ba306ed286c77c8bcb6c4
SHA1b1a3d27be369b388d3c94892aa2f7c984bedd7d5
SHA256e9c587e892dec296351b170f403526a3eacf95dc9dde43cd1d899db87d97afb5
SHA51250f4cb883b6593c8975a56d967ba0fac7fc24dadafed689f182d985fa255c0c8ee3bf07abe1858ff0059fcbc9be25ad61b512ca96febc5c2690e906c9f245391
-
Filesize
384B
MD53a24ec2b49d8f4baf3c150846239f2be
SHA120468e7a789ebc8bd7ff1e39d2377b95114f1518
SHA25601a175e585ca86be6b5627c8cf0812e730ac030133e0c65932dd084ba92bd490
SHA5128d962066f49adfbcb2a6f6a89271f98420df711a235de3b2cd87b0818b318e58be3ebf9c885ff42469b852ce6e8bdd10a22c1fea1ef67bc11f6f62adccda138d
-
Filesize
384B
MD5593284c77a53eade5068c3de51a553cf
SHA13af109fd20b3d978f96a168d5c465209488eadb1
SHA25675c1839b01e56bbd396e7150d58b6fba18dbe4eda4ff60d598721b7df8cfcc43
SHA512ade46f0c117d063c933174052bfe8ddd7782139a9501a671efd95664b685bb323ba95a08ebe076d110aa73949c0eef2dca6464b388b5cafbfd71d9a82c334cba
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB