Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2024 22:13

General

  • Target

    4fa433797a0339c2568889b58134a94921b7c62c07af9a5876c9572dcc7a2583.exe

  • Size

    29KB

  • MD5

    f91b9b8fcd7c63c17465ecb45dc4e3fa

  • SHA1

    c1d98b07eb325a123d36c7c16a1bd7c7cefd9d06

  • SHA256

    4fa433797a0339c2568889b58134a94921b7c62c07af9a5876c9572dcc7a2583

  • SHA512

    8427b78b55fd0e065b64abdbf8e0fac6004bb4b12958037387862ed162b30f21f7f97e8e1afab10c048dd70516574854ae0702765473fa0984606ee3a58f44db

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/1:AEwVs+0jNDY1qi/qN

Malware Config

Signatures

  • Detects MyDoom family 11 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fa433797a0339c2568889b58134a94921b7c62c07af9a5876c9572dcc7a2583.exe
    "C:\Users\Admin\AppData\Local\Temp\4fa433797a0339c2568889b58134a94921b7c62c07af9a5876c9572dcc7a2583.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\default[2].htm

    Filesize

    310B

    MD5

    2a8026547dafd0504845f41881ed3ab4

    SHA1

    bedb776ce5eb9d61e602562a926d0fe182d499db

    SHA256

    231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce

    SHA512

    1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\default[8].htm

    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\default[2].htm

    Filesize

    305B

    MD5

    157431349a057954f4227efc1383ecad

    SHA1

    69ccc939e6b36aa1fabb96ad999540a5ab118c48

    SHA256

    8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

    SHA512

    6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\default[5].htm

    Filesize

    312B

    MD5

    33443d670ec18ec5e45fb953d3da658e

    SHA1

    9d9c94b8068cd033993ba88f09167fe2e9a0f2e3

    SHA256

    17b499448dbb348f9e602eb55465357b3f396c4f9f1dcbf91536fd330731fbb1

    SHA512

    fce7319569621c571e361050ac3e075285993313f0cf2b61aafd8cc43ec0960435f89d314672cc40ce36b0d4e8cb7ab91c99d53083ee5927362592e3e6874040

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[1].htm

    Filesize

    313B

    MD5

    ffb72ab4faba49ad441ce07db37dd8b6

    SHA1

    194e13c1c32ebb6e7a1dc912261cbd58a82ff71e

    SHA256

    7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660

    SHA512

    517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[5].htm

    Filesize

    308B

    MD5

    5243568476eb2052b2f3b67dc9053e86

    SHA1

    b126aa6506772f9024b76580bdf28b45e3a7f051

    SHA256

    2d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80

    SHA512

    3c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\default[5].htm

    Filesize

    312B

    MD5

    5431b34b55fc2e8dfe8e2e977e26e6b5

    SHA1

    87cf8feeb854e523871271b6f5634576de3e7c40

    SHA256

    3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

    SHA512

    6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

  • C:\Users\Admin\AppData\Local\Temp\tmp73B4.tmp

    Filesize

    29KB

    MD5

    92e885761e93d8dd21cb452382a682bc

    SHA1

    f581a654589326325dc256f37b90920da1061d9f

    SHA256

    7f22a885903256461515bbaa40dd12f4798ac702d0fc8540d2a5919a05b0df52

    SHA512

    dd3c0399b6765139a23619c6dd2d90c238a4ce36ae3473b72601d45053056fd6f4da7f0cffd544d2db52cfd5a78436c81d84b82f80345e7e9ef70a99070e2c28

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    146843fa87cdc4da6bb15ef53fb2748c

    SHA1

    211027e88fbd724c12683590cbc49a7512173e10

    SHA256

    fd7e55e50ef06838f1769a72f3471c456de6aaf0d6c08beb38fc514b6263a485

    SHA512

    7153888309d3a2b89bf8578a2376f3503580fc0dc24f33ddd268a3d2d33cab3a021f8e2ad54827c94fa8adf2f2f7b478f93af13975ad276747da4e050c22d35e

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    77a2b62115cdc029671f7b8916362691

    SHA1

    099032be09b09d82b781a4253e9430b5237bb69d

    SHA256

    20de37b57ee269ac7004f8a1259b008f9d0d44434b0a7382450e0c3793ad8234

    SHA512

    2f2ae1a0aab69a6d52cdd358ac35ef483b61ea4e7a08ab8789b114db8e36eb2dfdba839ccb0827fcf79bce2f4b5e517b0ed71e4bd2792baf3b48184508d7b6bd

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    12beb3a126eb8df946b45e89ca5b8b8f

    SHA1

    21a4eefaf80486499bb3d9c685236265733a93b4

    SHA256

    cb2634c65504c2fc91bb49b128b159cc5dd6918c1685c828ea1aa7f508144e87

    SHA512

    052fd20472b613b30eb6530113246d705ae43e4ca8eb9cc8938fe3e6c3562bf9ee4e61b0d3d90ad1b9a252237e2f25de04f33e047c3250bd5f2eaa3187a4ae33

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    d9d71954af828f74876ef1b7a63cb57e

    SHA1

    22ab26712d2df4793a6c5f5ffbe6fdfeff5ac019

    SHA256

    234bcf1b6b0a0aecd8d3d02bd774862d20df04545e0ac11f95e610dcf1cc8ac8

    SHA512

    d9479257c68d808b99c4dd621da417d8dccf381ca22d605b13481336e2c407a192154464da4bd123400e3ca739c08da09122aa91c2f1281d8103f6e014fcefc2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1512-113-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-32-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-127-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-27-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-240-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-136-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-216-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-267-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-156-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1512-183-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1972-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-160-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-186-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-137-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-217-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-132-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-241-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-128-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-114-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-268-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1972-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB