Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 00:29
General
-
Target
8d59fd1ff1dcd1b491f77cb4ea10c2d913b769c9a128e8612907809d6c8ab782.exe
-
Size
29KB
-
MD5
c76bfe3321c94cfca32475ef4e2e9bf5
-
SHA1
586123c54268bab56720852cd494f85a04589718
-
SHA256
8d59fd1ff1dcd1b491f77cb4ea10c2d913b769c9a128e8612907809d6c8ab782
-
SHA512
678a772b962864ed5194006cb5eb6ef6f0ee600d1ac3fd02de8adb3b58a788d92645cf49d9f2d0431a1d8e5a5310d36479802de247c68bc671a51401620a9fc7
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/TJhA:AEwVs+0jNDY1qi/qNy
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d59fd1ff1dcd1b491f77cb4ea10c2d913b769c9a128e8612907809d6c8ab782.exe"C:\Users\Admin\AppData\Local\Temp\8d59fd1ff1dcd1b491f77cb4ea10c2d913b769c9a128e8612907809d6c8ab782.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5385fe43ac5e3cfdf219f1e379a56f173
SHA1372ae2bbc0c67e211efae6832b002df4868b7088
SHA256f102ca3388ae94794211389bb2a7e1b330ef2cbef5f1a992ce9d6c52e0822f29
SHA5127e95ca76eb9ddb0837bdbeb78307f407f758916602c3d665776c8c783aeb3aabf3780dba8255d55cb091269b78a5b1d72bd7f92c77b3554943fdd204c2d16974
-
Filesize
320B
MD5b591522d5e80d34ce21837082b104242
SHA15e18da5803fa199d1cb3835e264f67a3e0961cb4
SHA256b7d98b53d55cb0025b9f3c3ba4e6bc94306b2cc88ab6b9a805c8df5f8b36910f
SHA512aaf6e0279ed574afd20977a6be03f2a399ab703c7331029f893134c67186de74009df474c7fe2e88ff7222ad1f80fd7d79c1952d5d457cac8ff912a7819779fa
-
Filesize
320B
MD51e02509201a63701fb44b6187c1ebd08
SHA1aa74d4f8d618866c1c4ddbb8e0049cb2186dd307
SHA256ad4377d573789f83a1d3e5880e71c197d851a0b3f38ee31922df84f658c3759b
SHA51298ce46d1de511405b13f7959d2574de1706b2350d2388bbff61b2523452f9bc97ea292976cb311802b48437ee021c0829c3a4209f8999d05ba9ed5859930c210
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB