Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 12:48
General
-
Target
86aecb3fd21183c652c592b7caaed221d8a217f1e7bb39cbf8043851912885f9.exe
-
Size
29KB
-
MD5
15a7782aaafc35456a8bb4c34e09f72a
-
SHA1
37efc5426ae5d6ce487b0a1d357bc370bdc33827
-
SHA256
86aecb3fd21183c652c592b7caaed221d8a217f1e7bb39cbf8043851912885f9
-
SHA512
1066fe50a61d5a5ac24605324ab034b4531b5689ff773055431ce317b933ccabe2eed2eb895dcc49f3a0f3310d98ce4406b8f7699cb2f03fd3d9e1f0e94038c9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/xhg:AEwVs+0jNDY1qi/q5i
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86aecb3fd21183c652c592b7caaed221d8a217f1e7bb39cbf8043851912885f9.exe"C:\Users\Admin\AppData\Local\Temp\86aecb3fd21183c652c592b7caaed221d8a217f1e7bb39cbf8043851912885f9.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5f9a37e54a1dbf05424cecc5ce4f39163
SHA1092c608d12a5e9a78a17d83616fc7fcbf30671dc
SHA2562cbbc9d85b1157c41029b7697c04ad8b5fa6db564bea53fd62f578ada9a715fb
SHA512de2427eaf3e396bb2e0e1c69a9aa4353996270cf6db5e75a9db992c203f8c6291212549e102ff6f188b429b3298be0a5d566a0c63a1827d8ada907e73241b625
-
Filesize
320B
MD52aae172608bbd2fd53b54bd5bff756ee
SHA14771d38345f6c572f3f696dfa30003be60698b35
SHA256a1c65048f4131e73a1c8bb73445cf285d3b64af2068a6f6e8f8ed68e6227497d
SHA512521b60ca9d4ac51a30ac3d7889556aa5f2b44d7143aaa74535738b780e5d591db220be9cdc236d4275d60e68bb974d6bc8253769887b0f040b65ffee74af3ba5
-
Filesize
320B
MD522c90db0d9c2817dddb58577467b137e
SHA180e1a46e94db491ca6046134c398fa15701087c6
SHA256202c1a8b0f2aecac4b134745cd13ff1c006abdb2bc09cd03382138c4f2faa277
SHA5123a0db11249990659127759057ce2f91ad4e9851a4f814f7b0a4e79d814d48d92f195f5df08745a73bb82e86291ab06566e55f1777d16d9b1a586a0f803ca66d9
-
Filesize
320B
MD5451cc606797d2506bb47a6a31eec4f55
SHA128e63a6d87528fb1610275c38da4dffc62046410
SHA256236fd88d5b7f89171c59010ea219c05826c412910d9c065a02c220f0b60fb96b
SHA5124b9b870f2ffb2e74a32c765221f858463ac5781ddd22a63a3d3d9c200a87360e7ae195d4662d0fc8ff5f14d7915b51321bda0fb8622ce4dcd677b57de891c5ff
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB