Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 05:34
General
-
Target
58cfedf982f6ac7f1b0c934ce996fbe62be1225bdcb77726ad47ce4a6db19d63.exe
-
Size
29KB
-
MD5
e3555e03aa21f69f2046ad09936154e5
-
SHA1
d2eb9bd624e4ed03d1001b097922aba9217303d3
-
SHA256
58cfedf982f6ac7f1b0c934ce996fbe62be1225bdcb77726ad47ce4a6db19d63
-
SHA512
620fbe68d7920008fc069151cafa314beb7390c8f8c5924af02eb8d5b712e1fc4e531c78ab872f8627ff464d3f8bd937d2334301ae92769efd667a50875ae9d9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ri:AEwVs+0jNDY1qi/qE
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58cfedf982f6ac7f1b0c934ce996fbe62be1225bdcb77726ad47ce4a6db19d63.exe"C:\Users\Admin\AppData\Local\Temp\58cfedf982f6ac7f1b0c934ce996fbe62be1225bdcb77726ad47ce4a6db19d63.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315B
MD514b82aec966e8e370a28053db081f4e9
SHA1a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
29KB
MD545c99563e518db9c93815ef8d6ac2682
SHA1778cab279378b1815e13ba8caeaccfa982bc3b2b
SHA25656d1676f7d08a25e20592fdcd6fb51854920f1334063ae13096c4605b6c8483e
SHA51258afc699392f8e175f60a727b577ef1d9cb89f403f819479fd22e0c15d20622be792afde14c6643d9ae3a7bd9f01b47b5868b3a044b83a53da555555be8c3a1d
-
Filesize
384B
MD5812559875f819586a4c4fa8817b35a09
SHA10b9c4926f14f5a84c0a9cb0b95a7632a0ff3e1f4
SHA2565a2a2a1a699bd31a8d1d9b17ea88a457e23cca5fb9d0f30eb33ebd5f4f48450a
SHA512cfff091bd7084d8517d1c760a0f590902d1d6cb1ca93628cc647b9cce471fb37299c148bb4ac56b5449d5ff462936173ec63d857ade454c61cd0f22dafc3e1ca
-
Filesize
384B
MD5bc99dc37e6d352ff0be40ded91ab0d81
SHA1be51de0b97471abd1498739ec052e7601f68a55a
SHA25613cf802dbb4aaa5d9d16e6192045d12ed04af4f25b872f7afe36a72c17a64a23
SHA51244c397b3e13f1ab46e5022f2a7532ef1e5d84dfbd31181370ea61346013b0bdc27c208ef3a3b691b27e7ffe7ae3757e61cc42dddea3c854ac54c8d93ddc143b1
-
Filesize
384B
MD5b63ba5567288bf8265f4c561e6f44588
SHA14f8778da6d07dc4212a2c27baffbffeca29d5f7c
SHA256f14fe7b130a00bf70b9bb7efb43800180aed0d586f54e06ce0c13c356ccd047d
SHA5123e1695380a48e29606159d45feb86b4bc4e8a4e935ff3a830eb50e2ec79384aa38d29d4fecba375f429a686efeed2dda798a6968b2be9cbdab3ab3c3e7b3639c
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB