Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-12-2024 19:37
General
-
Target
0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
-
Size
29KB
-
MD5
e4c0f33384b8d465e5d385f6eb734139
-
SHA1
31a7dd9746a370554f85489170e84949ae534500
-
SHA256
0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478
-
SHA512
ae899ca492430d983272a49042649a012ac77ee3bdc240614e760d8e401333c973aef2dd2e99b2de64643bc20025c37ad10c7b0e4ad8bd8a1aba3e99ca7d7558
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/4h:AEwVs+0jNDY1qi/qgh
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe"C:\Users\Admin\AppData\Local\Temp\0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5238880e8933682e14b8394fe2331ea97
SHA14354467a23e88539eff4a00413ea05268406c041
SHA256e70bc71476742aad712d7ee18cf6925223457dd7cdb5058f0a98f42f7474bd30
SHA512e1402b82a1b8582779efd192e45cb3df1e2822bef2a218908e79d8a003e2a9bb9cb729eeb79bdfba888fa395eeb4756b9045c85bb347cc81556a585968220513
-
Filesize
352B
MD5723ce8d3bb182aa86a3d87febd29ea99
SHA1a3c30144db70c29b52f00e2a81bcaf0c5bcc7ae0
SHA2561715b93403540ea1837b5e151f8a090525145600f826a79d340abeee25990d2e
SHA512dcfe4d3632c394da3f1f2e35ed55dc67dd815c6402acea90aad3af2b30f4a8b936aa2bf0f796441cf0955396bd13c4d4e791f64dc877bbb23a710134e432388d
-
Filesize
352B
MD5497457542226a538a1f07a262654071a
SHA14d9ea5c82a8059c6f6fef07da4450c44f8545c77
SHA256041b91f41b8d1fc7185e795ff026c666154cecbdff6a1bab4053f8d5dfee1fb5
SHA5123d44f2be42cd4412aba23477459a099bf570fd92d75ca212a3f909e82f60d36595e1fd97fc7490616607d7bb0f845ac84a94c1cd67c83ff67f8bf531a64f9d46
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB