Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 02:21
General
-
Target
bd10a5f9f788adcb200afd720da53bd505eefca27180c3e3d6b28cc072db7ee3.exe
-
Size
29KB
-
MD5
e971f8f2c0a295ecbb8ad4cc74809a1c
-
SHA1
24b37cbf39f2c0776e88344a7ef9107189f12f07
-
SHA256
bd10a5f9f788adcb200afd720da53bd505eefca27180c3e3d6b28cc072db7ee3
-
SHA512
b47a80b2f1a5fec43d05e23c0699c9c5763a273bd48c74986511759aa4c9695c7fc86a754231e8a00835a95b894243afb2788c99b696565e3ef9dbdc82dc1576
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/X:AEwVs+0jNDY1qi/qv
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd10a5f9f788adcb200afd720da53bd505eefca27180c3e3d6b28cc072db7ee3.exe"C:\Users\Admin\AppData\Local\Temp\bd10a5f9f788adcb200afd720da53bd505eefca27180c3e3d6b28cc072db7ee3.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5b47917cdb1e192211ca75568592a32ec
SHA1f7fa89608b28c7af312cb2a23fb0b6e88309a253
SHA256a628207949b57b7f5c58a2d2695527ad61bc9a5cd6a49b5b6669040e32c35e1b
SHA51256f1eb70838eafa9dd98ce779ad811de0a6e67b49fafd351c96f9d54cdc95ffcf9f62dd525c2dce5156e97f7859ddb99f805377af563f54ad96b7f3b0969ddb1
-
Filesize
320B
MD52d62a8f4ecbbb646e3af2a50fb852c52
SHA1f35060bfd236a927a30cda27172d16aad4e76447
SHA256a115983e2c237ad990235be9e0e2d858251eb728dfd500ed887b07ab344bc43e
SHA512aec67ebb29d33db2a295508198fc290dc0c246eee86a4dcc2209f6a000ef239eff7b99ae60154a98632c4ef1f0dd5e8ea34535ace5b8e0d2b930f3941aebd647
-
Filesize
320B
MD511f2cba659b6d7e32173003325e0a5af
SHA15cb93cf54193c78209a098102a32b4e04ccd4c92
SHA256de8d726322e2cad1e556ccf77198f82ff6647a68865125260fdb26c0ca62eb7d
SHA512a021cf60bc5d10a70dd3e8a5c61784ff9b4b4ea0dd8ccfb1324965d145abe79bf9b39b748a8c7f5459d467b8c28781e807f041c1f8739db3b3d2e7e62c98c6ec
-
Filesize
320B
MD55a92be05a183477e35b4b371dc7cf72a
SHA1e5d873e0e8f20d53d4b8d42df21bdae109620283
SHA256dbeef12713e57217a61b67e90f2955118e5cc7903b883a74589f161c4c3e279e
SHA512f80035a80d7f88161fb54b3cf98382b330065c31ecbd4e9f9d4a0ef4cbb4e7be5e000f1d192ed10b68214843404f27263b4cf0c265d100a803aaec5ab0f4804c
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB