Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 10:12

General

  • Target

    d2c9b13fbcb91ca9919f8677abcd9f3a8841652764596ea6b15a2e5d09eea5d9.exe

  • Size

    29KB

  • MD5

    63994f8265324da9c23523d783f596a2

  • SHA1

    df1d54ad5769d64b2f26d6c4cf158822cadc5a38

  • SHA256

    d2c9b13fbcb91ca9919f8677abcd9f3a8841652764596ea6b15a2e5d09eea5d9

  • SHA512

    35d66b0ae20f346538780bbfe4e6b2d2ae7da7d9544dde334be9d9184050c8c1bb5ef7e30dd9a58228b3b36820466f8ec89be85c7938caf56b5434e25ebab369

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/D:AEwVs+0jNDY1qi/qb

Malware Config

Signatures

  • Detects MyDoom family 8 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2c9b13fbcb91ca9919f8677abcd9f3a8841652764596ea6b15a2e5d09eea5d9.exe
    "C:\Users\Admin\AppData\Local\Temp\d2c9b13fbcb91ca9919f8677abcd9f3a8841652764596ea6b15a2e5d09eea5d9.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB389.tmp

    Filesize

    29KB

    MD5

    b9ca71bfa9995db604c39a83e7d11c24

    SHA1

    fd8d37986f1912b3532c1ca5598f6493fd5bde28

    SHA256

    3661b075960056d95179c79f2062af20835aa8a69321af451660c302f1d975e5

    SHA512

    3443758d30033373501cee11943a40736386b7027a490feaeed99724345b8ba15f036fc925a636b20af74046a47e39605ab5539935dac4170d5a71e0d92dfeeb

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    6685e9f36af078829220d85112804c4e

    SHA1

    ca1856bd32a455420fed4a7904f93587ed22e897

    SHA256

    b7288789dcd6a6d009cd53b4b628a58a28e681082c4daa27f0bb66fa9b03dd4d

    SHA512

    ba1e35caee594904a1b256ec7e2b65b666ee2848c3d13cf42031d37b0a05135f043bb75a9ba19b9251e61bbcd9de53cb022f8d7d77423f0a7a3a2c88f6d42a31

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1244-36-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1244-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-76-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-69-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-64-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-60-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1244-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1244-2-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1528-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-61-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-72-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1528-77-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB