Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-12-2024 21:53
General
-
Target
da6fc91374ea8c9028e596adc121ee19731f36946d5c1f59d2e28f0874194345.exe
-
Size
29KB
-
MD5
502a9ca8782ea6d7685054dae391607c
-
SHA1
e13007cd97818fe565a337e2572f6c30b10c866f
-
SHA256
da6fc91374ea8c9028e596adc121ee19731f36946d5c1f59d2e28f0874194345
-
SHA512
1f81af2e529a39ab2308808a20df92a12f6d981399845dc351feb04e1973b44cb85d0c8c336eb401d5942cb2be8a916602bcde96d54cd160b72ad6b74ccd622f
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5hb:AEwVs+0jNDY1qi/qR5
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da6fc91374ea8c9028e596adc121ee19731f36946d5c1f59d2e28f0874194345.exe"C:\Users\Admin\AppData\Local\Temp\da6fc91374ea8c9028e596adc121ee19731f36946d5c1f59d2e28f0874194345.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD58b3158d3b1880fba39fabc70a3fdbec7
SHA15bc877cd9689953d27e93f025aee9969e52dd757
SHA2569d93fa418a3ca276fa93b7cc62af4cf4df6af8955548839e000b2dc54ddc368f
SHA512c78abbbc944c4eab6ff7bed08a1ba916001fd91fa88736e7d304d1261f8bff617f45beb5a97aa0eee4613bc4758f28fed0982f0d381e3a8dcdd4e6f694eae9c6
-
Filesize
162KB
MD5e5e9319a37c43db687b060341a68eb21
SHA146fd41971deef09da32e31bb27618a2a720f330f
SHA25669961d36609b8a890205d1ad6dbc69fc2b83b4c4e1653f22262dd808384b3074
SHA51232ff9ab47ec3c55933366c808f3c48a1c808fcbbc524a601f554c474294a9fc873a0d192e31a48e6aac2f8a21eb1835601e9b9610fd96191546a5232ed2b7dd5
-
Filesize
116KB
MD5154bfa26bd01695c6f734c42055354c9
SHA178afae73b9ba46b6f07cff6a10fe419313db32df
SHA256fb6dfc1b2c3aee256d57c91c4bb5fd84a2a7bbe68eff1772f89ab42d8f92cc9a
SHA5128dec7827a877a0442ae19c9c11e083e554551b75d764458ff469a76df01d80127191d103ef9de020777dcbd4ccd1ea159d2976dacdd58f0c37146529915b0342
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
162KB
MD55c83918c2d5e1a41da17c23a93df0755
SHA1f1bc6caf32efcadf102153af8a358c9c699c6f95
SHA256a97f4f4d3f747b4809765e8c905f6c05d75a12e1c737729c1b3e8c492465fde5
SHA512e9ca21a1ccebc415d4153edbd4def43795763a53643cb44adfc5c8f6e538ef165416c20298b9258c4451f0c18a7f59a40842b92f0171dd70d1a0fa945f11cf3f
-
Filesize
29KB
MD5ec75434110ced4becb8436bed11f2a87
SHA1ad1c85f1599f0c01c75e3ea568d4d2aaba0b8176
SHA2569e53368c4772078cacb75e3913f030b3f192815ffd0b26cde6f1ffa9910a2c5a
SHA5124b0662526680e5f5280f9806939949ad96c182594dc3225d8fb640215367b40a3839d993167706ebb5b3e68af7c79ac28487faa23b0ced6f78a07f04ebe37050
-
Filesize
320B
MD5e057350322b8f5f31bbd7efb0e29ee21
SHA1f01a688be1231031214dc17547cf31db958dfc7e
SHA256e35bfc9ac288f58635cf909057fa237cde389c493e18564dd6b961d514e86da3
SHA512c1f680dfcd982aa094c496517f73d75cc7644809a4df93f7ce65116e5ed0649eb553ce6ecdaf8b730101af329f24891b4519f7856fcb2570e7974451562ea30e
-
Filesize
320B
MD537cd499e6b3f9a94a4945bba9517235e
SHA15d956ee6f645d7f396f453b98deff4bbe30f49f2
SHA2561637250321fb06edd3645a98fe6f0eab67518f9da9bf5a692bfc901d28f346c0
SHA512ec2219e325e842bdf2de410375cacc941262422c2a86db30d06c0d92a1e612e65458f901a261e0e49afebf8bd71dc11ef289bc1fc4be12cbf45d8100c9309b76
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB