Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 02:04

General

  • Target

    da18f26d2e3390719f915cf3882acd0e042dfefe7d53f3a42881096ffca3ba4d.exe

  • Size

    29KB

  • MD5

    94e6629a4d93e97d251a3dd18eac93aa

  • SHA1

    48644cb3d382fbc095c9119fc92f7e6f0d886fea

  • SHA256

    da18f26d2e3390719f915cf3882acd0e042dfefe7d53f3a42881096ffca3ba4d

  • SHA512

    e8275bf1683382f2ba5439eb306e6220ef2f1720af258fdefccdcf9994dc8609369efc271631e6d8a9d6bff50e8328d5da50036fb728d4001061b027759b5b87

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Th3:AEwVs+0jNDY1qi/qrV

Malware Config

Signatures

  • Detects MyDoom family 10 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da18f26d2e3390719f915cf3882acd0e042dfefe7d53f3a42881096ffca3ba4d.exe
    "C:\Users\Admin\AppData\Local\Temp\da18f26d2e3390719f915cf3882acd0e042dfefe7d53f3a42881096ffca3ba4d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    87b0b8ba17d79b726e26375caedc4be1

    SHA1

    b1b4fffc7c8fda5ec9c6e16df4688610383d703c

    SHA256

    128eb6280ec15c65f31ab98633bf8dbd17152ac5cbf413e726e79d315af3b7af

    SHA512

    2370ec88715b496fc38792b0ad797ddf4b064bfb202108de50a5673e1a3a8b0ea59f6cbfb2ee73d25d0ac992fd6046dd1e071d834bef5010d8baabcb4e1c8c59

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a036f5e203e241e9d20700f31d0341d

    SHA1

    20ff897408bdbd87760b0b884042f482bc056c6a

    SHA256

    1329f0690123eb48b8b202bac3ef4196f02b781800ece1e85b29bb97d180ebf5

    SHA512

    f959928974ecfe097b8706641703f625c19b182d2e1e1e93ea0249cdaa7cd000b71b1d261e47ac455ed38684d12bb2cba5c50b92b0ebcf15bd26e42321ea8192

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\default[6].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\CabA868.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA8D9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpA0C4.tmp

    Filesize

    29KB

    MD5

    d350e08b7e4dd33a4d1d49ac440c0c45

    SHA1

    712812480e363c7f1580e56a8a165fb479989765

    SHA256

    d3f26222a91283dabf661611eb21a44c5f468e4469ed8961b4419a0392e45fe0

    SHA512

    6f8cdfc8b32939271a8aa0ef80c6c75f6e9fb322bd9e0483b2b35d193a03db5aea91a89bbe53653dd5691e61f6233504cb225b5ab1fd68b47606d7080bbba7aa

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    ea93042d91a272ee6a1e45b8f424e773

    SHA1

    ed379e9229caacd536581a68e02ae6f39dce09cc

    SHA256

    b264623f2f1e6e643566fc79cbc84d5c065aecf06653b931d6ad6e09c20fd757

    SHA512

    7da72761cbb7192bb248bb66404355cea1aa4eaa85068c619ef52b40d0bc78adef4c00ce507f747584abad2e772b762f904fe66607a15d2d2561c9c26e69ff50

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    dd913ce142b162923333b6b829d31e07

    SHA1

    bbc38698fd3bbf6dcdf91c7e38863f3f255907cd

    SHA256

    12075c1d6349f28c6178235425d5bd03a7f9efb80d7839cee8fcbf66390dbd97

    SHA512

    8c5f0f8f27d8bdac6ca0db48dbbdc6824e4e580df8678281524e409c1e4cbc72809bab815e5745abfc80b5e664519c2f362f510c0f47df332d54255fec7d4c0b

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2532-61-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-73-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-299-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-4-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/2532-225-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-55-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-9-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/2532-57-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-36-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-78-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2532-68-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2588-58-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-67-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-79-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-226-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2588-300-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB