Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 05:42
General
-
Target
63ceed707dcc8682cee502bd6c57dfd12bb8a747a165b30be4be08ed461ebb6fN.exe
-
Size
28KB
-
MD5
3e9e5c1ae6f88d2b06444eef4f00bec0
-
SHA1
3d87fd0c582a284ac4cc476035ac8bc6f8bc8f75
-
SHA256
63ceed707dcc8682cee502bd6c57dfd12bb8a747a165b30be4be08ed461ebb6f
-
SHA512
721076cea64b1fcd8baf35721061c18e034439eb02ddd8e5ff32702bdf3dc633d18196ee022525090bba367be1e7601f19567a4123d3502cb1d0e1b2d30dc064
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNtnro:Dv8IRRdsxq1DjJcqfkro
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63ceed707dcc8682cee502bd6c57dfd12bb8a747a165b30be4be08ed461ebb6fN.exe"C:\Users\Admin\AppData\Local\Temp\63ceed707dcc8682cee502bd6c57dfd12bb8a747a165b30be4be08ed461ebb6fN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD515f06b6ce6a47ceacecf05ca42591802
SHA1dada232061edc5497442e5bbcec7acb3fd23e837
SHA2563bc11000fd6abad4312cf69bcb4351c3b4ceeae26d103b697a73466077898c29
SHA512fb4d0e15b704018cd2539938a130e3c3ac2b54b77341c7e63a5270585e65b3dc83556c906cb2fd773c8d16cabedf42acaf37ffe99823d1846ae4ae66edc01d7f
-
Filesize
1KB
MD5d89ac3f30fcf3e9bfbe64d2226f665d1
SHA1e4741d06567ac0874f2a9f756b8bff84725e07b4
SHA2565144ac47f82530014d584812cdc7b99b9e6463520c1547ee55a8d172cffa157b
SHA51203aff4a2a717c8990033c18ad1d338871cb6fe937f0b5b3c781eed4a8c2ed44e6e71b904f053cfa5907d7fe9997584377b80f65ce88c8ae576c2f0c6a9baa19d
-
Filesize
1KB
MD5f162ee555a95d416ba9c85367e6e022e
SHA113b483c5a9fb603f5651520833e14936e7b5413f
SHA2568c95d57647d60289742847ac440aa6bab337fa2260a77d91b46a09c9f93e1015
SHA512e5459b9001797e52d04406728d9cb124bb65fa17a8e22d9d9a2b312142cab658817bf35e985a103193c3a2f9802ef5e6b8b7281fd7a04980433b9015e0242f0a
-
Filesize
1KB
MD59c82b2b211071da9f5129be6d3b56f8b
SHA13104a8cbf5ba602eda8f1ec4ec8192dbd8789740
SHA256ff87330488d42276654e2d26d373ff1d53a0bf441b40d339c5a88f93931b9194
SHA5126a30ce164114e1499c418290de5ceed77a0c78a4f10fe5239862e1b13c745519f20577d132541e0887279afa9269de3eb94879d84b7fbf6ff4b9201f5cf433ca
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB