Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 12:34
General
-
Target
4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe
-
Size
29KB
-
MD5
e5fd63a404de047a53f753615901eae1
-
SHA1
10714a9ad626db5f1daf3e682b91670a27026366
-
SHA256
4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1
-
SHA512
67f62f7ec381b52cac459c60f4e8b0393627049d6736b21f543a1f8b0ea5f98803cedcf14d7e7871796d64fdaf9a51b45b7b4d9898a166b7b6759177304d917d
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/1hh:AEwVs+0jNDY1qi/qt7
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe"C:\Users\Admin\AppData\Local\Temp\4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD526d8cdecd2e918497e0be26939235ce0
SHA12d62032153ef5e0a12181adcc83de0d2b0b20ad9
SHA25665d2e8e0eee1d9e36aaca8caa295e5dbf233b0523813fe96cb3655a5fda1f907
SHA5123108639faa0185fd3cad28561d13475c13f0ba0f0f6610ed853e52bedcf0d7d6b2b365a01003d07c4f6d5b38296c4abda5cde86227b8d617517e886305caf42e
-
Filesize
320B
MD56026ce74d86b46370bdd6d458e4d878f
SHA1d0be46b74d6a221c379e2eeeb2281eede9a2f41e
SHA256bb43619d4bf99a3a00221efd00c50eb92db0fa7a05c86d39d07564a3baca6355
SHA512de05311b4b747ab35b5acf5c4ff2e097d06f76115560bbe9733522848f56107301b41b8ccd173779b841d278c3bdb11b9e05bd5ba93776a627039ea8fd989894
-
Filesize
320B
MD503c9d982e02c867fb5dc0e9236138dd5
SHA12c6a6fe6bb892efac1b0e0e9b669e186ac6cab46
SHA256ec08b45da1e5af67365e86952d964af9fca93fee5860095cf7118e1933882c0e
SHA512e9b651cb9ae37ac0703760f7399aa05c23fb189c1edd5808d82d9fe7d5206f4410dce994f85c24d4876474c4d11fed7423ce0c416ac1cb5758046d3d820359b2
-
Filesize
320B
MD503fd1a7f75ea505d4d84099eaaf9189c
SHA1c05ed112142a23283cf74bd0f3d7a9b7a9ba512f
SHA256201deff71a8298e01ee008fdd1f4cdf2c620c2823fec39428be0e2cc29696c29
SHA5128dfed13f38bead71fc9411f00959d5b154a7161b4d6d2f245e6bc26268d45c72c1df2ff9238e5c8ba9024f73b387b13915aa0e7f306ade82c8c25f04fde1f76e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB