Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 20:31
General
-
Target
2860cdd858735028c22cc60a52bd89ce09c14c51a841c77e68d108abc8320150.exe
-
Size
29KB
-
MD5
172a1538fda5a9ac14d2f1eff7ab9601
-
SHA1
fac9207d09f7d00527e52ba6a5449517c46bb590
-
SHA256
2860cdd858735028c22cc60a52bd89ce09c14c51a841c77e68d108abc8320150
-
SHA512
f64baf95b7448c00359a37fb1fa00324b9fdd1aa3a60d894c34ab094b535b59ac3838ab6d5d51c42f662dca74312b373ee35ce6568b5335950dd6f8629d52ace
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/1hD:AEwVs+0jNDY1qi/qNR
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2860cdd858735028c22cc60a52bd89ce09c14c51a841c77e68d108abc8320150.exe"C:\Users\Admin\AppData\Local\Temp\2860cdd858735028c22cc60a52bd89ce09c14c51a841c77e68d108abc8320150.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5a19824b537fd487e2a682622e569364b
SHA13544c2ecc69e22ec7f92eb96517e0ab9bf63dacf
SHA25639eabe8d102d7baadac1ce3e2ef5c7b801ffd235a8496e23eecb88b49002db28
SHA512679fff8822ccffff5309418ca088cadbd2ed95a3d6ecf4f0a7723e2e40d8b79850f5da722149107afe82c08b41f426aca3ca95f01b2a889368ccaec2edbdcf53
-
Filesize
320B
MD5035b9c67292f4c1343954d9bacd5fc99
SHA1351d9bd05cbdbfbefda65f16504a448f703559e3
SHA2562fc7d1d99a3ed03e142d08a357e1603a59bfba1c7fafebb799c6843afc460d4b
SHA5125778b6e4b9aba84dbdd28ff7af82bba688d512d184d86300699f85907fbc3caccf0e6350a6816a6733afa8db4c359282205bb4163aa1230e659d82b7f43513a4
-
Filesize
320B
MD5cbf74672c450d03f63d459733cd35254
SHA12b63104fa240b389a63426336a91dcc3c06820b5
SHA256940d1d80bd43e6489904816c76946640e228941059c8dc77cf88c92beb09dbc3
SHA512598d1edb1aeb09035c908e6fd6958aeea45fc317ac3db2789bee99cdebeeda37eaad214914be4a0773886a9fdf20df04439cd4fc51055e5dda9235021660c8d6
-
Filesize
320B
MD5b2c05b1e6be7ab2e683f4f23af7040f8
SHA1d26168ca5334551b9bc888d203b76898444ef868
SHA25691a9b98a4d821c322ea64dd41aacefcfa2fca0e44f5b9716e565fb1b3da88aa0
SHA51259f522640b6cdaf18e75453e72218b32be03029f85c8e46cb1a1777b06531da69f25c2ce6e5bb22bb89cd36a2732730014deca5b293a9d640db2933113c03556
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB