Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 11:58
General
-
Target
6ec022f839a8b56157a06432094d874ac24172acb4970d4c41e1fbed8a447630N.exe
-
Size
29KB
-
MD5
fbca809695939136951fe7396547da00
-
SHA1
2f0cece709f4f3f9a2901656170c2e637b0c3245
-
SHA256
6ec022f839a8b56157a06432094d874ac24172acb4970d4c41e1fbed8a447630
-
SHA512
58ab22d980b54a70490ec168aa96da079f96d472d3f9ffb459541503f385c3ea77e620219cf9616de5a50ba720c47f9f805efef72934db9c53352a53f0e3643a
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/mi:AEwVs+0jNDY1qi/q5
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec022f839a8b56157a06432094d874ac24172acb4970d4c41e1fbed8a447630N.exe"C:\Users\Admin\AppData\Local\Temp\6ec022f839a8b56157a06432094d874ac24172acb4970d4c41e1fbed8a447630N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5e5c2364375c0a8a786a9508a840b6299
SHA1bec1874db0d2348274b6656d1383e262f73e2bc6
SHA25651b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3
SHA512ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD50b6d0696f1cbfa59d4e58dd8cefdf3c1
SHA10f2d149a9e48c0d5f0948d3efe7bba665535f7e4
SHA2568b5d579c8a65c353d7c51a38c7df850cae981ade3eee9f8630b527192da2c872
SHA512da58ca9aa3dc182edc7dc7629ca618eca485e45695c464536e77ca40f71e000c2ad179de6f9d734c0d1ce4decc80690e2964ae91b1c2833aa1d4deae72001c4b
-
Filesize
29KB
MD50edf9bcbf10c6345f3dc68041c03bbc8
SHA1c316721924843fae3d4a164980318dffdd66d1f5
SHA256b0c8badb05b40a5be42e8e282342ba5bf2c9c40b478f6ebdaaa6641c0049af04
SHA512f9506f10c517b3752c18899a050201c25c7ec02895bb971087de15c8128ac34813921b3556268aa70d859bb7b7728d88e13601d68dd5ba25a25db2d914607ded
-
Filesize
352B
MD5c6e98ba2385f2d4683b3da8c94acbdb8
SHA12ce98cfc5ba4576da69f0d13d61a163a09fed2e6
SHA25622a42499159b8aad7223410692c6e29a1b4c4410aa8a4fafec9c8f3fc3885a86
SHA51211aef44f721151e0f650f31be19d4ff2a6ab25eb91670dcf6fa134c9f5aece2cdb9f3ce321bc665b70cad2c325d661ebeb678c6ff19efbe81ac297688761b2dc
-
Filesize
352B
MD5bfaabbe9a0b5b6b0c9feebe25e8d7f87
SHA1d558bf64e7dfeaf17eb494f27d8a05af17ccc01c
SHA256ebca6bcbcb9b8d4adfc61eadc077b3ad611bffbd5ccf1394da4218e343c988f0
SHA512162ca82b25415a096e6c890db6919a835d1f5df7b23cde905af9750f23ef474346aa259a3184f9aa065dac6be66a421c2c7605c72078c53e165df208f13e500b
-
Filesize
352B
MD52b809ee1f1577b57e09c782626a3d243
SHA1282b78eb020f47a8d947cb83dc11b51c4134548f
SHA256baa2a312234bd087c605fc337b9a1a2ed5d4ec8d9dfd1c4ec0b9bd9a3fd17395
SHA512152498d1a5d1a4011daca6f24b87bbaab1ab6660e1f2af0242ddcf35ff6f7a3a853c74c3863e5ada4e249ef65104f4eb0780c4b112c99786d199b74d06875c56
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB