Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 20:42
General
-
Target
14a9968bf1f786cfd47becfa91d9964d261c469b997562ed20a609a2f5f888ca.exe
-
Size
29KB
-
MD5
89458048f914d4879f780ed70c6a57af
-
SHA1
46d641dbc99ebc29053281ad27b51d8f6522c9af
-
SHA256
14a9968bf1f786cfd47becfa91d9964d261c469b997562ed20a609a2f5f888ca
-
SHA512
e84b189182ada3f1efa0c6b0e4c00cca2897635c8fc2700b80c40d2c336a963f4bb0d698f4e69180b8722274d67c1baed7e77752c0716d56422aade07b5831b4
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ShQ:AEwVs+0jNDY1qi/qam
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14a9968bf1f786cfd47becfa91d9964d261c469b997562ed20a609a2f5f888ca.exe"C:\Users\Admin\AppData\Local\Temp\14a9968bf1f786cfd47becfa91d9964d261c469b997562ed20a609a2f5f888ca.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5218c3af555cece93b1f88297831915d9
SHA1809fa666a75e882a6060e6eaf71985febe5cb425
SHA256d3215199fdccbad5acac7d13004819ee087528bc3af449e8c20e06254beb6eb8
SHA512e3769cff5465bd6a97e59b752538d7c06207b8bf80e694e82dd937eabb1c9eb9dbae94f7695806e9d9012428ba83ffbd1da64a3571938af2ffd3200b76ab28d3
-
Filesize
320B
MD564fb5217d30581fb447e8059a53e81e4
SHA148d7eeba1de7ca94d85a68bcff4262cae35893ac
SHA2560fb26480751460694fcf066892b59748429a7550966eb7e824bfd90addaf27ca
SHA51217e6e5e5b769e4dc344211e1904a726ecd5907f2cecb8f35dfcd3650f81a63d4195e4c48db60961e5640f3ff8c2ebcd5973d8c7605d19e5c0ce473f08e17eac2
-
Filesize
320B
MD5ff4261a61dd966dc0db38a368e8612b8
SHA1f70ac1f43d70c440138c015b55ad6639974d7aac
SHA2560f4811a8ca2fbac1d591374148a3773d7db49dae0c7c5207969a8e1211e3e527
SHA512b0a3870e69f0a94b582b5fe9e3f2abb2360503e7a1fb886123b4cd25b5418430e6e9ebc153ca1012af98f455974af1fba50440e5319b521828121be165a269bc
-
Filesize
320B
MD5ecfa76b589ea2c82384ecd182a300a39
SHA1aa54b5aac730997cfa494a5b50f92f13cf4aca12
SHA256f02309e1fd2cb5f6d76436ed428061aa971fd85842d172c0cfb479c89df76995
SHA512389a7381713d3390dc513d91a3c49864beafb0876ea143f9a3414ec2db658378245679c34ecd580163305c604b98349dd5f7d68ef5a7da8a5b03207339934e43
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB