Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 05:06
General
-
Target
bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe
-
Size
29KB
-
MD5
16a19a015797fcc308b68d18cfbd1cb3
-
SHA1
188a3fba954565d4dea5ecb57a3f2a38b10e7982
-
SHA256
bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3
-
SHA512
20f08e793ba4d53216b7a1755b6d40f7f0bd9c5b9c509e9ff5c642d7a69cf1ba064eed9d0b9b5b11e6caa9232eca0b0cfbada7968c0ac57c3a1f0bff8941b929
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/hm:AEwVs+0jNDY1qi/q8
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe"C:\Users\Admin\AppData\Local\Temp\bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
304B
MD5779eb6e922262fd34798d1da675ff1b9
SHA18ac9d18a9f1fd8ddb1bb8e6638c4faf7c38c08f4
SHA256f5b7521dca08f599000d2234268361c7a0de6d916540f07841bd28ec4d28fa1c
SHA51270654bf9abe3d5a399d9e010b4ba12743f789cf78f1c9e41ddf1377dd5179f24c871dfbb89876e17c2d1206ac18f49f42d0ca54517e2c25491d34c509b053ec7
-
Filesize
304B
MD5267ddfdbb8d492b25de208d84b290f1c
SHA19f57d9f19f25549e1232489a0c101a92e851de2f
SHA256ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA5120709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3
-
Filesize
304B
MD5cde2c6ec81201bdd39579745c69d502f
SHA1e025748a7d4361b2803140ed0f0abda1797f5388
SHA256a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5cc7cdc4459588c8b05a7cb260c4f879a
SHA174847b5db7aff5656273e21fb5030a02396c997f
SHA2568c01e8eff1ffe3be800f97311b613f5b981dfbb02af5beac9172232f8b3f7b96
SHA5129d307429f15403d6b155b2aa63d6d70a86e0a2f21b3ff1c527e136f3264aba538b96df96110a9c3860714d93a5e8ba04c84d3d0d303d8e11f6fbada541c2f0b1
-
Filesize
29KB
MD5019cf271ead6afc0a06ef49a5789f1e0
SHA1df023b6d470c065540ac42eff4bbf4a262d09b44
SHA256eb2476e886790de62089c2f5195b0217f071c2c13f8c76b24a1d8cd420713f7e
SHA512da0b408268d175e8acca14a0a7f13f4f0196308b52288c8efe57747e17a99e1c358ace8cb999a90e07525c35f1b77163e60e66c86926263296585f541ec002e9
-
Filesize
384B
MD57e7169768f8ae152347f377d7ebe9058
SHA1c1254207c4b0de6ee2ab1f3d8ca7e0b89987ff86
SHA2561521738ce4e9b05f4811720da614806dbfd1a9a1effc87cde51ed3d4909e50eb
SHA512aadb469d7d68205e0de27e4e4393e45f89c83f5ca122981d38d221f3587971619269dd92966971613f2da79f8d7fd1aa9321d763190034f02ed4eea57ea43c77
-
Filesize
384B
MD56c9212dd021039665dbef29002e93576
SHA142db2af545863a2283ed824cac72ade574e4dfea
SHA2569d1cba88dee9614be8d2a451c89b526f6075cd103875887b1b1d3bf2fdc99115
SHA51294c42ddad751c0f8f42b5ec5bb572dc832d4746c44db7aafc4c74998ad03f0bc8090e665b8ee5a21f054a70d23664880731296a5f2c305acda839796de81382c
-
Filesize
384B
MD51399de572c8907b4858da5939570c8d8
SHA19d9b3b97e4f2b3cec463211129683b1d0a679994
SHA256ef6684bcc66334d519552f5225a384ed22a26249af63e27cf63a044abb9ef69f
SHA51219bf8ef0deeec3f55ea60c00db30a0454518cfb8bb7bdb1ae59e935c00c38bd4262ebd77f6ca1de03cef8304f0aa7206f7002e1dc86f09d431aa92612d2f273a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB