Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 07:46
General
-
Target
d1a15c93941c4fa17173583353bcc4b032200f0f4b069506164f4872fcece80c.exe
-
Size
29KB
-
MD5
0553d465f71749b7d5bdc8929ce60237
-
SHA1
48def9b6c97e9a0df993b1478c176b8383a77267
-
SHA256
d1a15c93941c4fa17173583353bcc4b032200f0f4b069506164f4872fcece80c
-
SHA512
a098fed3bca420d0edf8706016904d6dfe4e09323a834f1cd66a19031fd1ccba6dc79aa33f4f1b3d0dac40d3d3af61579031708d51161764134c3601d92b62c2
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/TJ+:AEwVs+0jNDY1qi/qV+
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a15c93941c4fa17173583353bcc4b032200f0f4b069506164f4872fcece80c.exe"C:\Users\Admin\AppData\Local\Temp\d1a15c93941c4fa17173583353bcc4b032200f0f4b069506164f4872fcece80c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5d339b350e651d6d412adcb885b2845db
SHA15eed27ccbc359344f2f472c21d328dff1b3aabc7
SHA2565a22d57ef80dd5f382ca7ea1ac2d3274ebe0c57506051bf8652df260323d861b
SHA5128de2cdb8bebd77c7754e8e8aea84f53c09b9e536a12ab095fc9afc7a4e5b85a6c679a21db433ff78f46ffebf647fbfa05a5c9d6c863a0ae8f7d08cda1add951b
-
Filesize
320B
MD567c15720aad5e841693a48b1ba43895e
SHA14c0907706e5c51515b7025add075aeae3f1a890a
SHA2561cc9ec6117c94a3f2ee962f44b78f30acaad5f1bb398cc3fa3f6f78b6f4e86ba
SHA5120e4998e537313d8bbe50575e9f572b247e391b257221492e0fa6062e059bf69243fbef9aff70dbce5ce0c73ad4943034ed59dd7076d5b3e0fb1a4fc073b11cb3
-
Filesize
320B
MD55fe7431b512b91cb20ef16fe08411916
SHA16628f3bc0667f23cf9020d929a50514fc3237cb7
SHA256b56fc28ca925958763b6540209cb58e9607374afb18dad6bc06759c30224d9ba
SHA512241e21fd0478b1a422c95b835ccc6acf5b23e1bbe8dfe639bc147ff3703ff6c7f7bb0360eba92b917508893acbabd2a8b225384a81b05b1b304bc12328017579
-
Filesize
320B
MD5fa2e043f836381871eceddcea0f3563a
SHA1760bd03fd56dc26fcd270e8b37f7b4ae14415017
SHA256155ecf4dd3885ee02c13b586a8c3294c7ef6fdcf2b0c06b038ad6da75967c2b3
SHA512788459ffd4ea221f7b4d0c5c2da78d5d00f9d9507c52fb587f26c3cec7377aab8dcc197afc284dcd8aafe40f1b988457471c221855bbe50b57cb842d0bf41efc
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB