Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 21:12
General
-
Target
354c88db5b6ef2efb09b6cdca067d35f9d810ac13177df0d9daa3d712eeae7c9.exe
-
Size
29KB
-
MD5
98f307d849e939da0ee7a9b1dd787db7
-
SHA1
859f9e85275bfca8b8585bb5ff6d45234c377a7b
-
SHA256
354c88db5b6ef2efb09b6cdca067d35f9d810ac13177df0d9daa3d712eeae7c9
-
SHA512
51c2942be009eef9ea50c9d5cfc832065d5b7a307e3b2647506014d1a55cc94d16e7851b5fe2ad180706d5a1f4142d7733d561f632ceabeb1321bbe8ee5f8771
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Y:AEwVs+0jNDY1qi/qA
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\354c88db5b6ef2efb09b6cdca067d35f9d810ac13177df0d9daa3d712eeae7c9.exe"C:\Users\Admin\AppData\Local\Temp\354c88db5b6ef2efb09b6cdca067d35f9d810ac13177df0d9daa3d712eeae7c9.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5c4c6e7400093498dabb2c230ea0b0ec8
SHA1b151d225b2d26cfcbfe7ed4124adbf8e1432dbd4
SHA256a9170432f53991ee1b98298b5401f98d8b1bcf12fa78643d2af517048d5cb8ad
SHA512327b4f3b6fc33edc246dfe12f80b20a9b193407457fe30925a7992c32280072019efb5599851db973540e62ccb5d709d31b88c05a411bd444fbcf764ff06aa13
-
Filesize
119KB
MD53bfd939c55b9b941fe0beb7d0b789307
SHA173e9537ba40171971e58a2e775f14ad59956f22b
SHA256c732af83a348ca695a76fc2b9e2c1281a2c882495c6126e54e15ad9bc4fcbb1c
SHA5122d72ad357efb111c729c59a99fa0bcf9cb41a8bdb3166403f2884fb43235f9b3cc90ceac6297b88142456adcbcff7fda5f7fb855cea826f87cc6adc23ae1d632
-
Filesize
162KB
MD5569c084498e2180742f7347dbd23adb8
SHA119fcaf8bb815969bf1e53b1fb21977686a9864df
SHA256bfa253a70c98a3d78a6ed581c781cc1af17ec76fc296735c6346cbbaeedbd3ed
SHA512da439fca91e3422f495713884a42276570f0b8a640c8d2bf88fb52849e5d8aaaf89d93d1380c57f424dc0e1ec70d9b2f39e0b836900cf4a1bea67d5da29f133e
-
Filesize
29KB
MD5e84215988c2b6eb08aa3aebbf4a31bf5
SHA1ed2f5b8da2b4c8670d784865a889314785e9fb23
SHA256f9e2cffcc117004ab727d7e1fecea73989ef96fcf59b65d96a6e6fcc6325714f
SHA512476600a4d2a6e6e1aea8470f094c498be0aa9f3927193ea81f194103c60d315204d9c98011abc403d3d6f0ee6f6c0e5c4135473bfea6464984d764ce748f9f55
-
Filesize
352B
MD522890a6a383d3f72efe2e4666aede440
SHA138c46c8113a0e2655a9e8ebc09ddb982c2198000
SHA256771be58530b2cc278e4d9d106b6b425f5f71f2009021691c9bd441cda895558b
SHA512aad6eed80c4f557a7029c9c63d08f33fab2c786c8ded6521c357fcd63c82e26d7aa9cb172e8e96cb944b22c307c4f0df4290e1d96b9e7c4ed0f2e3ca3c973315
-
Filesize
352B
MD5ad73bc4af37f524bf03554627f4903c6
SHA1bf5a1cb2e19d08426cbf561de4e3fa5a663b29fd
SHA256a09aeb8508947df6955161b21c122876334ca893bceca255394ea19ee39c7917
SHA512af77388b28e5785fbcba21889625ecc804585c57fac83d916c5e782dc39237d26f47c64edc5e2244c3b80cbd1501a7785552cfc1db84854ff8590fbc74f87340
-
Filesize
352B
MD58a4dacee7078e8ba0f281faf1d742996
SHA16b080d2665d4d68f60ee48ff666f941aaeaf4d2f
SHA256f7cb2fbd8aaa4af2f06bc2dfcbffc62857a9c1a9a119fe0406f09ece8716b14d
SHA5121ec68da2825853604d52312cf919ffaaf01eff70ba7fd0cc81718539f4a37e00e44be24ce55c8ec2f77f66c31d5c589b5fe649dcf7205bf03dc4a0c4b6ec6298
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB