Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 19:54
General
-
Target
1ce56895fccaf9ed7c42062542942a4fca5591eecb77b4aec466784c766e0b26.exe
-
Size
29KB
-
MD5
2ef5154834e689f013207fc9a153be10
-
SHA1
51832a9a6452b8fd166411851213b540b8833384
-
SHA256
1ce56895fccaf9ed7c42062542942a4fca5591eecb77b4aec466784c766e0b26
-
SHA512
82a832991bb355a107390b089a37ac036536bcb9ddfc00a8599692df8e00656e0017b4a429aaeec9b06b27c0046a2608b2476ed04a214fffe2a049d47c0697f6
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/bh3:AEwVs+0jNDY1qi/qTV
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ce56895fccaf9ed7c42062542942a4fca5591eecb77b4aec466784c766e0b26.exe"C:\Users\Admin\AppData\Local\Temp\1ce56895fccaf9ed7c42062542942a4fca5591eecb77b4aec466784c766e0b26.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5b92d2a152bf6a56c9115f87f801cf9ef
SHA192df3c415d5331e66e44babfcfee5d1df3983b6a
SHA25635086e4fe44fedeaa81f9f0c69256acd1751d4d9477117e6c532cd274579696e
SHA512859eba76bbcdfc52a7a5858558dd1f8e8a7cd66fbc32cbc21491f726a0f197a07f19b9b2370474f21cb603d8940bf5889258a94ce4a79524e417657972aa35d8
-
Filesize
320B
MD5ce652be7999950f7ccf31e7c6d4f7b26
SHA1f7f8dd097a8160a6e3fec8ba69e6089a6fae9d2a
SHA256cffc40c18344d7e947d1259a6241229d87d016cd91d868c552313d9d2d0cc592
SHA51213989339fc32e0c45f375876cc923a5c4bb3f9d793b9b104b0c37c2ac45fe8e7674a90ae3676083ebb391efaa0d48d288c202ba7acb330b4d688a1c1fddc8f14
-
Filesize
320B
MD5db3e616dbd3cdd4deba6ae10c56e3fa8
SHA126ffd435218dbbe92037e11e0b415f8dc15a850f
SHA2563143af54df230d5405ca14b8c66776ffc4d15a617a1e477ab8a932c71db4daba
SHA5122039195a8eaeb0fdcb718522a6de4313de61bda767db0050c5ed8b9e2668895fa7c4e92107e5ce01d7bf30dcbdd4279b1e7aa8942c3775fba4651626f749570d
-
Filesize
320B
MD588f32a8f4b48f2fc85f4676c62b64d01
SHA1b73f3de2f5bc740ed4d77f9990bf822d6f70b9f5
SHA256dede5db86543e3fa0c57b0a44046fa39fa1ef71f3a43155a54889565f2b3c484
SHA512bc453fe9c55b6542c5012391a64dbf763bdb74b5ec910d8ccdb45204ff2e6c67897a653093f7f8dd8285a3eaa31818c7d007dcc54cae14c09568ad84c700373f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB