Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-12-2024 01:52
General
-
Target
c94521fd80678b71dc70c93410f9ea23184e2490b98e34c12e423bebf19a78cdN.exe
-
Size
29KB
-
MD5
6fc71e1c10912d7c16d87624c871d530
-
SHA1
aef95cc44b2fbdd50270b5fc0f521008a43ad27f
-
SHA256
c94521fd80678b71dc70c93410f9ea23184e2490b98e34c12e423bebf19a78cd
-
SHA512
3cebb266192aa2dece38865b26b8f04fed71a5a9a709bd6038b38b49d3a9565823db14fbe7bbfa3a6affaf03feeaf2ba8f0ed6cc7edd7373da77cfc21dfd4cfd
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/A:AEwVs+0jNDY1qi/qY
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94521fd80678b71dc70c93410f9ea23184e2490b98e34c12e423bebf19a78cdN.exe"C:\Users\Admin\AppData\Local\Temp\c94521fd80678b71dc70c93410f9ea23184e2490b98e34c12e423bebf19a78cdN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320B
MD5b699b5d33c8ef54e05a87df8eefeccd7
SHA13afdc1d67be0d6e3e88638735e112fe4477e1619
SHA256f88f36f0574245e0e60a904b51c489d293620304ed829e61134d6198c72aaca2
SHA5126962783acd0925c1f757833f453fa7610630b182016bcbc4f41d04933857d67feb7e6964adee8a3eaa6575f16c9c14c37e8b13301f32ff5387a70424aec0b0e7
-
Filesize
29KB
MD526b90714fee09e6c5061a7c1a84fda6b
SHA16805ae798b80d98ae4d79aa39045bae4c3c3e850
SHA2565038f99d8b5765c43d6291416ed9586c508b6995bed1023b505ac02db8e316da
SHA5125fca8234542ca48a06d614f13aebe026242d3ffb1555fcb9b96156055ef3176f6e66a9deee02bf879802ec78dee44fd3d89fb9188da6b49a7fb9fbf40933653a
-
Filesize
352B
MD59e6ffbe3127ae5cb8de3aa47ce142163
SHA14f0838f57036f5a3533b4bd150e08fb43ab2dfe1
SHA256ca89b37fdd571f1a562bb0b7c0a669dc9cc956074b9a99642fdf32e9c7a5913e
SHA5120ac8a1dd3575f8a1f9132d6a0761bd3044b3df415df2b89a6af16c1da3ba8aba1fff2fe08f81ea011cf6aa590978231a11420d8f146fd0fba50a2c73e8c41267
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB