Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2024, 23:17 UTC

General

  • Target

    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe

  • Size

    29KB

  • MD5

    1ad2ada71c78ea7ee5ac130ac0bdd9b0

  • SHA1

    cb5c0ac9599add9dba9c0e32308047c0baab9ac5

  • SHA256

    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240d

  • SHA512

    c6deedebdc966927d3a7c315bc1d2cdf0aaa649e375579c3c919987fcfbe7d17506ded705931743e67962b6d3c92f2b28cf2a5d505cd71f21ec6fdd63ee1f41a

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/CuG:AEwVs+0jNDY1qi/qc

Malware Config

Signatures

  • Detects MyDoom family 3 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    "C:\Users\Admin\AppData\Local\Temp\d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2684

Network

  • flag-us
    DNS
    alumni.caltech.edu
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
    Response
    alumni.caltech.edu
    IN MX
    alumni-caltech-edumail protectionoutlookcom
  • flag-us
    DNS
    alumni.caltech.edu
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
  • flag-us
    DNS
    alumni.caltech.edu
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
  • flag-us
    DNS
    gzip.org
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
    Response
    gzip.org
    IN MX
  • flag-us
    DNS
    gzip.org
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
    Response
    gzip.org
    IN A
    85.187.148.2
  • flag-us
    DNS
    alumni-caltech-edu.mail.protection.outlook.com
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    Response
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.17
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.41.4
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.0
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.24
  • 10.144.22.105:1034
    services.exe
    152 B
    3
  • 10.135.150.237:1034
    services.exe
    152 B
    3
  • 192.168.2.12:1034
    services.exe
    152 B
    3
  • 10.213.60.59:1034
    services.exe
    152 B
    3
  • 192.168.2.111:1034
    services.exe
    152 B
    3
  • 85.187.148.2:25
    gzip.org
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    152 B
    3
  • 192.168.2.114:1034
    services.exe
    152 B
    3
  • 52.101.9.17:25
    alumni-caltech-edu.mail.protection.outlook.com
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    152 B
    3
  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    192 B
    126 B
    3
    1

    DNS Request

    alumni.caltech.edu

    DNS Request

    alumni.caltech.edu

    DNS Request

    alumni.caltech.edu

  • 8.8.8.8:53
    gzip.org
    dns
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    54 B
    70 B
    1
    1

    DNS Request

    gzip.org

  • 8.8.8.8:53
    gzip.org
    dns
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    54 B
    70 B
    1
    1

    DNS Request

    gzip.org

    DNS Response

    85.187.148.2

  • 8.8.8.8:53
    alumni-caltech-edu.mail.protection.outlook.com
    dns
    d6769addab13297e6d45a396ff03a217a104d524486d4cc207fe49e2b73a240dN.exe
    92 B
    156 B
    1
    1

    DNS Request

    alumni-caltech-edu.mail.protection.outlook.com

    DNS Response

    52.101.9.17
    52.101.41.4
    52.101.9.0
    52.101.9.24

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp906F.tmp

    Filesize

    29KB

    MD5

    41e80d5a038634331ee3e29e5ca44e74

    SHA1

    cbfb26ac8daa22b5d5e748511e2922cf982d8d14

    SHA256

    b54639f8109d13a4ab97c870dc5b0f7f43365f3f579f52bf9d0cdcd64a2d15b7

    SHA512

    0835a115909776c0cece20b21bd035e994c6255bbf30c47b7bbaa7fec5a8071de4c0eecab494fe26218915579ced87ca7075e5221a0b7a6c1661edab9dddf285

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    6f2f9a6ec7e18be36fa4f88997d8b560

    SHA1

    62220fdf71392c7eef0931ffafc3b827903b932b

    SHA256

    bb7301dce0cddcd3a674282f570ba332fa978f648a07b37191b9506cae1e9776

    SHA512

    b65a14e495daeb6e9244f9b3b827109c8b36a8c37f8c106320e8fd72212f5c5b893a03b32b0362af49d25d353f7ccfdefad77f9d5f154056f1869717b2ce224f

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    91ef5934734f19eec8dac908f0b28fbe

    SHA1

    dc4d5745cb0d1d2f2b570ab0926b5ad9e8db4471

    SHA256

    0f9cb5447c7e93fc71c59c419edb337366775d64e6cf8d1a362bd0fa42a331b9

    SHA512

    bf9ec65bdbc7833b92f6d9d1cdcb71c9f2ce92db39bb2f0d21735d087bdd31abb15cd1f2be5f2c5b08ad2e64a4166e81a177ac39130136b0f24ca22f5142e155

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2112-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2112-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2112-8-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2112-16-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2112-17-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2112-77-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2112-53-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2684-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-49-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-54-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2684-78-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.