Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 01:35
General
-
Target
acbac121140c551c7d45f24ea8331a3baa791d265ae894aa6b001f7fa7e0d0a8.exe
-
Size
29KB
-
MD5
8d02f518ff84e2a418a36f506b8d4b0c
-
SHA1
2987e8127e734daef8d5d04b3c26ebc7874173cd
-
SHA256
acbac121140c551c7d45f24ea8331a3baa791d265ae894aa6b001f7fa7e0d0a8
-
SHA512
8e758a1c00549cbcebaaea52a47ea3875f97f38f6aa2ce3b5cbb66159e1bca0cc2076e3af4a0093b4c06618e586803af89b93e4b9ab19c69b9bc3cf0318f7c0b
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/TlhQ:AEwVs+0jNDY1qi/qJm
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\acbac121140c551c7d45f24ea8331a3baa791d265ae894aa6b001f7fa7e0d0a8.exe"C:\Users\Admin\AppData\Local\Temp\acbac121140c551c7d45f24ea8331a3baa791d265ae894aa6b001f7fa7e0d0a8.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD56fae7c22a6cf14e8848eeed54b72af97
SHA1f1996d2993e3b60417f68f8ebc305437d138d659
SHA25662c5da7ec5a4e28e4f3b9dd11ded5b26a2706f2bb8eddd904b3831d58684e0a1
SHA512564dfe0517ca645ce951f2b48355bc5ade4c7c8458490206eeecf8d85a686c119c85b90edffa71ef9d8c4e109bc9fe1a373b798f43d8bd94f90702cd65167be4
-
Filesize
320B
MD51642fcc6695e7461ca9359da8ec268ee
SHA19b741604501f727559f530761d20b7a8361a6687
SHA2563f1a544151fe55981a95eb22cae0ff1d63fef227b2ffb24ce99bb3f61f8da117
SHA51294298b407a3b84b6bfbfc63043fd1973245aaa4cda70e29fa939e7f93b43091986f5d310bbef7c5f27b3bef618526ea30ed696174840f238408fe15cbbd18881
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB