Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/12/2024, 02:44
General
-
Target
0430e138f6dd3efbf5a0d5fa99b20ebafbba9b93fe501ba8953c84abb5301581N.exe
-
Size
29KB
-
MD5
ef5501b6231c8ff627144c5c542731f0
-
SHA1
c31ceb5d994fc7f280e3221ce4ed250486911a45
-
SHA256
0430e138f6dd3efbf5a0d5fa99b20ebafbba9b93fe501ba8953c84abb5301581
-
SHA512
1f5429b923c5fc615b641bb88e73c7cbbd4f416aa22cda10b33d920d19bc1a6813052db9790eb3497af919b64a4ac65a314bb92ec8d0ba409ddb0bcecd605de4
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/jhl:AEwVs+0jNDY1qi/qrz
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0430e138f6dd3efbf5a0d5fa99b20ebafbba9b93fe501ba8953c84abb5301581N.exe"C:\Users\Admin\AppData\Local\Temp\0430e138f6dd3efbf5a0d5fa99b20ebafbba9b93fe501ba8953c84abb5301581N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5b5cfb588ff1ef24023b934888738dac8
SHA1ab3bbc30a11ecb4e69829df7085ce9e023e8259a
SHA2563c34d255218054acbdbcaeb2be24c8d2ead2f2f5532d166412bbb6ae40c77638
SHA5124b7cd23db08512a23be2d3b32b02129953a055d0c5decbc2a0f5028452524e790ad008d0eedce35c5b4ed8f385ff5a2d250dd5053cc223562613658d5ea01a42
-
Filesize
320B
MD506aa36827544ef676a4aa67340a1c5f4
SHA1999c80fe16e63d4f819b015ba27893c50e3b0978
SHA256e4044702061c5f72e32a6bfdfa8d879ea4735dc5395ff61024e3756730f34eff
SHA5126266265024655e719ace0e1b688ca1cc152dd111ec976aa71fbe2eb77b523cf754c4d31f614b6f976f6e25c8f9fff4afb98b7b2b49c28dd449a43d1dbcfe6374
-
Filesize
320B
MD539607021bcba8f072eeb49c8bfcc3066
SHA1606ef0c545fafcfa1410e2b51f2d9b073c712f01
SHA2563f16b911f65a02c30536555e695a6d2a5817e85d0534a627a5fd99fbd52f65a0
SHA512c57f60d6ef4065c5e9e66b7fb2b044a419b5f0105366546f1663a8bacf0b2846ccad688382ff447e6a59bf813340d77d62c873148429ebd76c0a88f4ffc2d987
-
Filesize
320B
MD53830a928791fd24379240b4140841c3f
SHA1f7dd962be279164a2eeff404719987170c055d25
SHA2563d622a2fd6e388e3d71574cb54b29e864a811f5c26cbe6accefff73b70729ef0
SHA512004f76139d4da65446f7f16cd6e0f16f0bc184e21bc9f192cb3aa165e6afdbf6df6bc2dbb63acb56bb5084ef3a6dde2cea647cfb6e45f09813703b630b194c44
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB