Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 10:50
General
-
Target
0bdb4d08f44771908f24388932846a700bee98f0b3882cfffbbaf6d6beb8ff71.exe
-
Size
29KB
-
MD5
432112f89d5ed2cf3ceaf6414fdc9dfc
-
SHA1
a2ec16f5818a595c2098b5158eab9ce3c49983fd
-
SHA256
0bdb4d08f44771908f24388932846a700bee98f0b3882cfffbbaf6d6beb8ff71
-
SHA512
8d90b609af42bf10e3e20e51a33f81727350994f5074c91d443ba9e6a1c7a9dc62537f12663c2e3e16f3d39c7f262907620cf3a6f5a21a596ae4cac45d4d70ff
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/TV:AEwVs+0jNDY1qi/qx
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bdb4d08f44771908f24388932846a700bee98f0b3882cfffbbaf6d6beb8ff71.exe"C:\Users\Admin\AppData\Local\Temp\0bdb4d08f44771908f24388932846a700bee98f0b3882cfffbbaf6d6beb8ff71.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD50f5d100bd34f84c746813c39335f9cbf
SHA154151cbd92abb89c17c7944142dfc9e92c4145e1
SHA256d2c866d3e7f053b06ca208f59dc9b7d657510f546a313d040d0181448472d63f
SHA512c1e5f3c244f777ce935ad589bb7e6473e8042de13c16804badbef860f3e05c40e1eb4fccb57d3d4816acb75adc4f46860f61b611a939ff4082e0e6b84a692630
-
Filesize
320B
MD5e0ec0bd51741766ceb13eaff5d512995
SHA155a156b08910ab8cf861d185b23acfc9bca316fe
SHA2567dbdc00725a721ec39bdf77ceb38d80c03b3687af4101eb778e461e1dc9912ac
SHA5123ac770c47db8e81b293d65b2229ec93bc130f88b776d51fa562cc32d9e4dcfa727cdc72c7514d3d1d5f3d0d9b134eab3d3eb0e3bfc2a00ae06b430f58deaac18
-
Filesize
320B
MD56e08e01fdde7347a4193906443fe4c5d
SHA1d98bcc0f58198950ca2497a896a464532c6f0905
SHA256c7ec2f5e763fc52c0a17722793e4ae27e2eca035f0e3f9716260c7559e17f74b
SHA512b998aaddd2c59265ba7a1a83cb38cc91f870137d2bbe362e52723ad85118c7a06014d5430fbae3e0d0657969e0e20c1fda02fd549ee793742443f2e1e6f0f65f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB