Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 19:27
General
-
Target
0a482459c59cd3597f9ecc2926c3eaa738d6746e81c4344142a23deedacbe73d.exe
-
Size
29KB
-
MD5
74719c3bd13880dca07373e8d9bb6571
-
SHA1
eb37feee1350e302f115be2590d976087be4c420
-
SHA256
0a482459c59cd3597f9ecc2926c3eaa738d6746e81c4344142a23deedacbe73d
-
SHA512
9cff2c0faeb5c86c743a5549d7335bd96372795eb855d427b55bbf96d3deede36202219be43f26ed406f94c7e47f61833e68e52da578eaf723589ef254920963
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/7hA:AEwVs+0jNDY1qi/qjy
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a482459c59cd3597f9ecc2926c3eaa738d6746e81c4344142a23deedacbe73d.exe"C:\Users\Admin\AppData\Local\Temp\0a482459c59cd3597f9ecc2926c3eaa738d6746e81c4344142a23deedacbe73d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD59366edb9c9e9ed0ffe97845878a28790
SHA122c7beff9c9b3ca629bce54acbad6ee97398c8eb
SHA256652afd905ae355cf4c14c0c877f151e1d8b78bc69d09c4a0478b37eebcc77489
SHA512b69fa13c228d5af8fdac1a6e83673e1aac6baf22fd169f7b52b2cfc5a4fe6df6bb58625c4a8e7c7bbaf90b1d58bee455d35d73718334f93512f24bab9b6cdcd8
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD550ac55627dd1c0eccfa7cc391786ae1e
SHA1263b288ccde0c9d3cc4184fd857b6a240fd7dc16
SHA25698439f133756e969b9faa00ff065429352b94b0d4be0369bdbe4071ab095c002
SHA51277e56e57632506c22d7a12df5a8fa1a6cc6e84d3e63e3ade47dd0a9286e0b8d601a84d4e68c5c2e42d22959d105bc023a0071ac49a75a0d4ef0c7cc76dc1d969
-
Filesize
320B
MD54f18df44b173f5479a26c524a76a7840
SHA1223590e2ff5b264dbb1a284fab49dbb5df82507b
SHA25664a5efdb87f2cc613114ea77e01865518c77a5f0c90475ea41b93eb3baeaf111
SHA512f55958664422f6a1c62079959cacc75eafb07773b47644ec0f7c54d7bf05568a63a7656fa3d545fff7de946db5f55374182f86f3daf8b75ff5b4c0094c2ae89e
-
Filesize
320B
MD5ca40e4bda0105eefda8037a86cf56009
SHA113ac5a0162241e3081a9f38105eae50f2295c1af
SHA256ffd1f6d49b4a3bca89a37978af9085b5615dc8953bf1ceb0a279a792e87f4f64
SHA5122da6286d95e7260d07a0fc3ac8c1cf86961fee0969c99622d2cf891b1310c782d3988c7773787839ce62c7a3ebdbf5166ccede32caddb0a17950bde92249df49
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB