Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 05:06

General

  • Target

    bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe

  • Size

    29KB

  • MD5

    16a19a015797fcc308b68d18cfbd1cb3

  • SHA1

    188a3fba954565d4dea5ecb57a3f2a38b10e7982

  • SHA256

    bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3

  • SHA512

    20f08e793ba4d53216b7a1755b6d40f7f0bd9c5b9c509e9ff5c642d7a69cf1ba064eed9d0b9b5b11e6caa9232eca0b0cfbada7968c0ac57c3a1f0bff8941b929

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/hm:AEwVs+0jNDY1qi/q8

Malware Config

Signatures

  • Detects MyDoom family 8 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe
    "C:\Users\Admin\AppData\Local\Temp\bfb98d24293760c802f4ae01983510ca7428d748a41ce5701b0e6329fa1e82c3.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:68
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\default[3].htm

    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\default[4].htm

    Filesize

    304B

    MD5

    779eb6e922262fd34798d1da675ff1b9

    SHA1

    8ac9d18a9f1fd8ddb1bb8e6638c4faf7c38c08f4

    SHA256

    f5b7521dca08f599000d2234268361c7a0de6d916540f07841bd28ec4d28fa1c

    SHA512

    70654bf9abe3d5a399d9e010b4ba12743f789cf78f1c9e41ddf1377dd5179f24c871dfbb89876e17c2d1206ac18f49f42d0ca54517e2c25491d34c509b053ec7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\default[4].htm

    Filesize

    304B

    MD5

    267ddfdbb8d492b25de208d84b290f1c

    SHA1

    9f57d9f19f25549e1232489a0c101a92e851de2f

    SHA256

    ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586

    SHA512

    0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\default[2].htm

    Filesize

    304B

    MD5

    cde2c6ec81201bdd39579745c69d502f

    SHA1

    e025748a7d4361b2803140ed0f0abda1797f5388

    SHA256

    a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

    SHA512

    de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\search[4].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\tmpCC37.tmp

    Filesize

    29KB

    MD5

    cc7cdc4459588c8b05a7cb260c4f879a

    SHA1

    74847b5db7aff5656273e21fb5030a02396c997f

    SHA256

    8c01e8eff1ffe3be800f97311b613f5b981dfbb02af5beac9172232f8b3f7b96

    SHA512

    9d307429f15403d6b155b2aa63d6d70a86e0a2f21b3ff1c527e136f3264aba538b96df96110a9c3860714d93a5e8ba04c84d3d0d303d8e11f6fbada541c2f0b1

  • C:\Users\Admin\AppData\Local\Temp\tmpCDB7.tmp

    Filesize

    29KB

    MD5

    019cf271ead6afc0a06ef49a5789f1e0

    SHA1

    df023b6d470c065540ac42eff4bbf4a262d09b44

    SHA256

    eb2476e886790de62089c2f5195b0217f071c2c13f8c76b24a1d8cd420713f7e

    SHA512

    da0b408268d175e8acca14a0a7f13f4f0196308b52288c8efe57747e17a99e1c358ace8cb999a90e07525c35f1b77163e60e66c86926263296585f541ec002e9

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    7e7169768f8ae152347f377d7ebe9058

    SHA1

    c1254207c4b0de6ee2ab1f3d8ca7e0b89987ff86

    SHA256

    1521738ce4e9b05f4811720da614806dbfd1a9a1effc87cde51ed3d4909e50eb

    SHA512

    aadb469d7d68205e0de27e4e4393e45f89c83f5ca122981d38d221f3587971619269dd92966971613f2da79f8d7fd1aa9321d763190034f02ed4eea57ea43c77

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    6c9212dd021039665dbef29002e93576

    SHA1

    42db2af545863a2283ed824cac72ade574e4dfea

    SHA256

    9d1cba88dee9614be8d2a451c89b526f6075cd103875887b1b1d3bf2fdc99115

    SHA512

    94c42ddad751c0f8f42b5ec5bb572dc832d4746c44db7aafc4c74998ad03f0bc8090e665b8ee5a21f054a70d23664880731296a5f2c305acda839796de81382c

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    1399de572c8907b4858da5939570c8d8

    SHA1

    9d9b3b97e4f2b3cec463211129683b1d0a679994

    SHA256

    ef6684bcc66334d519552f5225a384ed22a26249af63e27cf63a044abb9ef69f

    SHA512

    19bf8ef0deeec3f55ea60c00db30a0454518cfb8bb7bdb1ae59e935c00c38bd4262ebd77f6ca1de03cef8304f0aa7206f7002e1dc86f09d431aa92612d2f273a

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/68-162-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-39-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-222-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-44-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-191-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-142-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/68-171-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2128-163-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-167-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-143-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-172-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-194-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-223-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2128-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB