Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 03:42
General
-
Target
ac7e7dd48f4b08bac468c320f2e682d6c2391d6f48fd02bdfbc9af9d7bfaf79e.exe
-
Size
29KB
-
MD5
ac2b0fda7d1a42c8996cd89ff1a3bd97
-
SHA1
71de667ffe285a5380fa1520561e821ecc28073c
-
SHA256
ac7e7dd48f4b08bac468c320f2e682d6c2391d6f48fd02bdfbc9af9d7bfaf79e
-
SHA512
b5faadb62ec9905bd31d804cb36d7f6cdd616f5614aa718922edf9a3dbb325cdd415dcdb8185317d18e8231560d88a3cc4491f4bebd0caabb0f2f7426976bb76
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/mhp:AEwVs+0jNDY1qi/q+T
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7e7dd48f4b08bac468c320f2e682d6c2391d6f48fd02bdfbc9af9d7bfaf79e.exe"C:\Users\Admin\AppData\Local\Temp\ac7e7dd48f4b08bac468c320f2e682d6c2391d6f48fd02bdfbc9af9d7bfaf79e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5ff5c3647addec4019a1a9efe355eaede
SHA13cac30fdd2d7c37be8dd6db6eba68758613b54a0
SHA2567f9995f1eb55a1a17f3702547eb6859b9da8d9e2f9b70048b03f888320a61b39
SHA51203356a8b922d17b1645d13849259dcf7d2396b49767a0de00019c6850fa7355a921246cf88a3443683eb3a4d07f0b021b95b378dc6dd5c1d017a38373e83f7b0
-
Filesize
320B
MD5bc4b51ef2906bb34d2104fffbb79e19e
SHA1e9a30475d606f13082958b5c1c2ad54511b7b7c2
SHA256f3c7965272e69f649230b1b7b95f175aa45e7d50f4fed6d5441582cf1bfd146d
SHA5125e776fe20be0a40e948173986b3804d79bcd26a85f39b1240a2cc0632ef94ea5ca23402a90912be1a28a2c0c2868cfce8132f4ea61e4248f33eebaf5d29597ba
-
Filesize
320B
MD59915f872b1ddd3c80ab796e1a0d19f3a
SHA165f077d627cefc188e0c18dfae03efcd9819d1b4
SHA2560316b4c26b97da0b928aabe535bb936889cb6be0a73f62623144431caedef28b
SHA512a16f4ee20836c8293681c702d0eb354fa7425bff6b7ebd949eda62a1b9e7bf548d6c03cf4a0d3a86c3f29180469313c8bfd32420e1fd78f195d6879fe2049f98
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB