Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 08:52
General
-
Target
ec1ba1e0296b7b92bae7d9a9a99529e5f3d454a9f4897f851c224518c6821c57.exe
-
Size
29KB
-
MD5
9284d891a1f92a2eed3c59b096e41b56
-
SHA1
27da5cba3832cb16b0630c35ca1d0a166247fdd0
-
SHA256
ec1ba1e0296b7b92bae7d9a9a99529e5f3d454a9f4897f851c224518c6821c57
-
SHA512
15ad81b20a43ce9ebe5f055cdaf99611e60975b18bcc683b3d534ded0b7f410b32df6f37e8267d8ebf3e519a9f56610b12e9a88b2180a0313e8d62c5733ed41e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ihp:AEwVs+0jNDY1qi/qAT
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec1ba1e0296b7b92bae7d9a9a99529e5f3d454a9f4897f851c224518c6821c57.exe"C:\Users\Admin\AppData\Local\Temp\ec1ba1e0296b7b92bae7d9a9a99529e5f3d454a9f4897f851c224518c6821c57.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD51a5e8594c585dd1837a6e57ba2ae1cae
SHA1c1431d6b4fb72e27846dc186b9013237fdacf870
SHA256f048e1e40e74f5970c49c44ffb2b7bf56204fcc34085ec586b3d841ed9315d13
SHA512f28154de3a0d6eae9ea1c8ffd4c5564dec71fbaa0e502968b773c70ad5d6815a7950044cbc3431a29be10b7453c233c77cc8da375f475adf93d966be09608184
-
Filesize
320B
MD5ccea70f25c61c92545e1fff92c3716ff
SHA1b3f7ceae526ce11848871c22095d8e7ef5e94c44
SHA25698de747c304683ef45d7aa047c4c93475b738f653e4d8c8ec7a6ddc53cac90e0
SHA5129d15a64669c7c495a5c7c33214e091f412f44f480d03542fbad18de1e1a0bb95356770503e17c9c202d3800dc1a4fd8f680d214ec7b7e247c88a84661fd0e2c4
-
Filesize
320B
MD57df273d6fd7f5175ab11e0d8606dc854
SHA112aedc262c7ebcbb1ea09a4e82ab2649c35e6ab5
SHA256471c3f90774a5f6c56d5769bd2953074c5d8239e7760d069b6d06d133ad11d59
SHA512ed79110a9961dafc4a25d1ffb581f006dcb41c1cfed1b1163fb7d56fea36a26bd407e63829adb87ab2ebde51f02b363b20cd343be5e449102e4ed1e4e7c63fc8
-
Filesize
320B
MD5037780703df440d2d847cc4cba5bbda4
SHA1469034f08b7fdd291729b50c5d8079d4574fc408
SHA2565e1218a0fe7d246285f5169901f40c20b5d1a9f3d79eeb9b35e4c3fb9811fcd3
SHA5121ab45d352f334b589f8dd06b5475d1c14fbab4aaec622cfdf4615c5ad7573cf11edacaf24902fb735b08139e07ed4afc36f4a714ec06a1907d0e1453df782a6f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB