Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 23:16
General
-
Target
e33fa72ea42f8ede6b16a178d73558cb3d7d8ce4da1b7034fdae29ae62d2d58fN.exe
-
Size
29KB
-
MD5
6880c69ab19612e0df955a8953819600
-
SHA1
a24ff2f08e917bc6a7cc88aa4ec8182a8ac0b255
-
SHA256
e33fa72ea42f8ede6b16a178d73558cb3d7d8ce4da1b7034fdae29ae62d2d58f
-
SHA512
b11dac9661c1e18f844e7a8ff0e25a75c38ed893703c7157caca277fb330eaabc95323e5b29db2609625aebe0a6956469d06aa7c49fd7bd454b923c7e5205636
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/8:AEwVs+0jNDY1qi/qU
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e33fa72ea42f8ede6b16a178d73558cb3d7d8ce4da1b7034fdae29ae62d2d58fN.exe"C:\Users\Admin\AppData\Local\Temp\e33fa72ea42f8ede6b16a178d73558cb3d7d8ce4da1b7034fdae29ae62d2d58fN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD58f715aab01c7a574c4cbcb86a018e10a
SHA1a6e3757e50b9c1ab20ad06c7b78e6658e39d37df
SHA256792857b22355d8f4b862f554005ff4434ff0ecfa6c90b95eae5d67a90ed52f9a
SHA5121dee64cd8f10b8c1c680382b78454d5122b88e8e6268cee616927657d98887fd8eb87836959e6ab060192050537e72adf800c835b6eadd0982b703e122f08061
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5215aa9e635613a8e958cf789af752b71
SHA1bc9c86de8ce2e239120dd31a983c8e875f5bbcf1
SHA25686684c232dca2c08fa886ff1aa346d84d9b0fed026f1b0e973f889fc8b802fdd
SHA512dc10b52698e390ccbff0063a53b33ef4ad55dbaadf58a506a44a402c07b8b6e26df76abccd9789d1de59a921d74a321beb36893e7ccf9ae2bf608f3d12f50d08
-
Filesize
352B
MD55f22fb336432b08a861143f22521a9a9
SHA19e74d0a383ca42f477a3e060ee9b26c4a0145d6d
SHA256ef649cd3644de246380984b6aca81f4a83823f76677f3c1ff411f64267f9ff6e
SHA5123bd517728263b085f100d26b4dcad04f2d2babb5be0f7846f5fd4ad0e84b7576e438837f54ac390d0d321172b5bef70db3f1fdaf1d9e7bf3e606c40b375ff066
-
Filesize
352B
MD59b1bbdae8e7003bd8000b2024c8a7312
SHA197272e8919ae6a712fc3a561747f2ed32bf2400c
SHA25651bfb50a7ff8ad9cfc365bd5f0306686b8072f02a729372e3513f45559c961d1
SHA512392ad82f43fcabc05a8142b337155db3675958695b6a566aea20fa9ddc415067e646efc119447b5c3731bf4eb87497294eade2f47c364014161a3eb53af88c8c
-
Filesize
352B
MD51706318213c570e586ffcc5cc4b70a00
SHA119c9b808eaf9ab148c21cbf3740d7b41c2e1a1b3
SHA2560be85b161cea7b53e0f7528c9aa591abea90fa7869de78975459eba3b64fb286
SHA5123e8382cdede9b332854de560556ef2f9ac73d30a879d0418f6e573c87dcc40e5dfce3d46792e9e7513b652c55c227d960ba80e09e7aac77c68f377a1105d0115
-
Filesize
352B
MD5b332a99557e5380b78db4eb739604837
SHA128df77d46d08ca2da0777b76ea28adb28b1a674d
SHA256b3dc1c56cf1cccb578f599b580a8eaf0d59e561f105b22f9da980a2e89d9d4dd
SHA5128269f9f1b2138cece9e24987072501b77b8b334d567be3b301f0189569c7ce3ede653d683cecaa32477ac866a78aea881d99868e54219ef048419a8e3920ec6b
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB