Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 00:54
General
-
Target
17e5fdcd480216efb0cee4543b3948f70dd543f0b1e0649dd410388583f315c1.exe
-
Size
29KB
-
MD5
c5e14210fc15be0ca9af84c235967aec
-
SHA1
bc6c4b6cc2db06ebed279bbef782d48bf5e147a1
-
SHA256
17e5fdcd480216efb0cee4543b3948f70dd543f0b1e0649dd410388583f315c1
-
SHA512
a78be34afd80983b51f8a74a0a838e207271d05304e53f5a74b945fe0473cf41301d7061daaacd1a8b255aedc5957e031c68f8555a7601a9d3e34b2af6b32035
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//v:AEwVs+0jNDY1qi/qnv
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17e5fdcd480216efb0cee4543b3948f70dd543f0b1e0649dd410388583f315c1.exe"C:\Users\Admin\AppData\Local\Temp\17e5fdcd480216efb0cee4543b3948f70dd543f0b1e0649dd410388583f315c1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD528e70b914c7ae6e5179396e4a48cb0d5
SHA17bda33445c407cf26752e1182b409a7ee97cc614
SHA25650bc0fca336ec1c1f96454cf3956147e8889834a32c9ae199084d35cef60c787
SHA5120e7bd08ae785a7d80ce887f0e8954b1f559d4d826eba1c16a83a7ade52b4e3dd006eeb7681b8077964ecab4e8f7304cd9e36e8cbd416f541da8b9af8728d89f3
-
Filesize
352B
MD55c8d388ba03253400cae9840b9d7edad
SHA10cf55d5005aeeb6bc88fdd02abeb83aca92efca2
SHA25641aeebee68c6f899c8ce7554ad3ca1f4761c58f2ab2208b4df55541e5d991037
SHA512139383e8228c8c9971e012ab58a66af422ac38b31ac284242793a0eb77f83e1774db44bcf969ffdf8d6e2bee6c1c8506e326a3d1a2591a2268f55cc2f22f53a4
-
Filesize
352B
MD5af28c67a0936e3d737760240fb54ea6e
SHA107a4b2c9ba6ac42b8988449548f2db9c0a359878
SHA256250282059cfe0c947f07dd95095b1e4eee9dae5ae81d2888b02ef7061b65992b
SHA5129a037fe6be6055ab12436694b3c91b584d7e196a19a699c4562ac60f8fa48fa40d8da18e8508d04496144b78071757199735f55a7a6eb4dc593c6cc622a16f85
-
Filesize
352B
MD541ce7cabec2acd755568635731c3f730
SHA12059d8468fe43425d7bd82b0215be3362228592a
SHA25675a075aa37dde5c1b774c797746d15d7a523cc43dc881ac209641f5c66768da4
SHA512c428d112d9eaf73bcb870bcad0fe916fe36b17f78f575cdb6c60e9c64f5baea40e3e978db33ae8db4e44cce0cace1f41418ef11bfcbd2f3ca9fc146f0e34bf30
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB