Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 08:08
General
-
Target
6f510997ae8f0bf3d7c828c848132bc3f76e07b33e446820fcd668936c3baf4a.exe
-
Size
29KB
-
MD5
b508d84719ed87a44e72bf26503fcdb6
-
SHA1
bd0da4f017b95a815d15f28e9a144a487eab35f1
-
SHA256
6f510997ae8f0bf3d7c828c848132bc3f76e07b33e446820fcd668936c3baf4a
-
SHA512
f3ae990483ca88cb92282f60705c589bda535d5a29835db5006ea68fb288cfb3b4bfca28a62ac9e6744de5537cb23c1ec90107cbb84e1151ea9bf2b6e4c992be
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Lm:AEwVs+0jNDY1qi/qy
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f510997ae8f0bf3d7c828c848132bc3f76e07b33e446820fcd668936c3baf4a.exe"C:\Users\Admin\AppData\Local\Temp\6f510997ae8f0bf3d7c828c848132bc3f76e07b33e446820fcd668936c3baf4a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD55431b34b55fc2e8dfe8e2e977e26e6b5
SHA187cf8feeb854e523871271b6f5634576de3e7c40
SHA2563d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
SHA5126f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
311B
MD5cb42662caffe525e9957c942617edf06
SHA1615009db9a1a242579e639ee0fc7a2a765095bfe
SHA256312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15
SHA5123e6777f1f74f64fff6cb2bd1a81a6c08d9a64feeebc3deb7cacb8f0f41b23a5c59a8e6294b99c76dd386aaaf9043a1a252ac47910fe1801bdc2995f7b675692c
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5c62cdb69c422f1d5548f06a9ce2ebdbe
SHA1c41ea465b423314d68d779c3512795e0b2e458c4
SHA25697703db1cacf5efdc1695492bb8a01f6346dac15e7e2ce6ded68fc649ddceb71
SHA51249c994847ffc26404759e6ae53240f1cb549d032ad5f6bf26990238b1156f8cb9772181a78cf80a312dd66771bf60ed631f4bd072585a8d8ab3c6bcd5db1e98e
-
Filesize
29KB
MD50acfb8ea5b29117a9c53d4025ec871ea
SHA13bbd211ec48beea0c537508e4768da5739f066ff
SHA256acce5cf389daed55bfc08bc13c9f14c645b2fe76e23af6fdaebaf50e07088cbf
SHA512bc42855ffe5d0b62775bbcf5a6a1977df3e2d0c02d4092b80e0d23a0b5ad8302952a43cd3eb7b455f25d152d4d526c563507e3d0903f20594a8e404324c48794
-
Filesize
352B
MD51efc327293c8b4b438d39eb64be1de20
SHA1c14bf5860afe5938a0960d7759063ba852b11360
SHA256613add6815bac51b2018c5a8e2cb12d448445ddaa4843664561a3d66d8746fc6
SHA5121812953a7020ee419606c505906bae7dc3411fcb0e883e931d8c9ead9e068880d02846abfb64f090c8ffd035bff2647d5c66129e55428416e34c256af8bc9de9
-
Filesize
352B
MD5464218af3b938b8c9fa7b2df26c25860
SHA14a48b52b8d24f2e32d5576fe74ece26b86fc6a9a
SHA2561aa60483ebfdf5573a69e44a7f868a2e7374e3456402dad2121b95bf2d481788
SHA512796bb51daafec9aa32d3194ecbcfe2c94b50dbbcfd48600b4683a633e880fc056471b80d166656fa2d6475bf1533ab5921d87f155ae69bfb663ee3e62d27da1d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB