Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 14:03
General
-
Target
9eca5469ed36282968242e359f7b902584c36c53ba0b7eb2a39dc7e349c3ad8f.exe
-
Size
29KB
-
MD5
4d26bddf762ba5097ab5b737cbe9db38
-
SHA1
aeceb718db445f42e524a353eb0c9ac076f703a5
-
SHA256
9eca5469ed36282968242e359f7b902584c36c53ba0b7eb2a39dc7e349c3ad8f
-
SHA512
1563efce6045b3ed7f091fd7ddb6aafcf77727b80573323f93ee647ddc226e5c137f625e0ac1a2985e39364dd0e7ce678b2d76a904bf42f9dc1224f94ad60df9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/LK:AEwVs+0jNDY1qi/q2
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eca5469ed36282968242e359f7b902584c36c53ba0b7eb2a39dc7e349c3ad8f.exe"C:\Users\Admin\AppData\Local\Temp\9eca5469ed36282968242e359f7b902584c36c53ba0b7eb2a39dc7e349c3ad8f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5f927547572ff5d88860a940b090131a3
SHA14923031bc3e65d9ff225a4252eb7d3329d0d08a9
SHA2565352eddeb66d7e7ddc25a32c5ce7b64ca4dd06533df5ccee8a14801d3d434947
SHA512e58ba88738fc2d61879c0218c04b9751e102911b37cc54bbaa6c01a0d2f88c4ec4aee7205a16beed60f42ece9f5ab0a38e8dc07162aa8435995d92b39cfc495f
-
Filesize
352B
MD5c3d67e175f3d5197e5db51fedc37a013
SHA1bb13c13f4a4951f3211b17b21b0604369a29c3f7
SHA2562b2c5d8e95a731de01855040916be4d149b4e55f92a5fc46779f032b0bc51c82
SHA512a53651f485ef8f25ef9ea8448d407c8e63883ff24e3d5df3f75eb7fb20f5e9101745e152247c8bc6cbf59ae7a8a6bb8088e3a96d063692cf28fca7c89e0092fb
-
Filesize
352B
MD5d38f65c82cfaf93cb0dac09cf013faea
SHA1a905861950b3f4c0edad6ef242b3ad802fe156bf
SHA256244f0e7c049e7ad85a2983b23065bef114faaefce0fc48db9d7151909c53f330
SHA51208ce413c11fb1935bf1d9ff514c7e3573017d2434495984c31cf16a3fc09e3cbad5c5db983052cf02d471003c77373a06e5e79db3fac4d4727e5c8c33feb3e67
-
Filesize
352B
MD5cc09ac2e2e1e85a2f1292cf8f8a35740
SHA17b0ce8e36c871e05d552fdb14ec7d202f37909e3
SHA25672a0e3e88f67100e3c5944b05ea7adfc1bcd8081537fc8744ec91e49ac0f5575
SHA512992600aec96b67fdc3bae9ae64a7dbf04b937ebc43bea0a6cd102e729d108202fd2b0e43033bc86ca815cba641a3fd6084216264ab36ffd6f2ee0d884a464825
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB