Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-12-2024 22:05
General
-
Target
3f3e2091bca0dbd24954f6f3bdbb96dc9956d543f5e01481fb59ed607f6adfbf.exe
-
Size
29KB
-
MD5
a936b75234266eb7a97e4aacdacb1983
-
SHA1
2234409100ed09a4b8d8e3b4782a5fd6d439be89
-
SHA256
3f3e2091bca0dbd24954f6f3bdbb96dc9956d543f5e01481fb59ed607f6adfbf
-
SHA512
78cea0f3d5885be2688925f8103f2a340533e508c4a43b28bf94b1e52f214bcd75c54ba1c74536527570dcd7211da44f9f84aef48c90ed91d5f64907cb3697ac
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/8hP:AEwVs+0jNDY1qi/qk5
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f3e2091bca0dbd24954f6f3bdbb96dc9956d543f5e01481fb59ed607f6adfbf.exe"C:\Users\Admin\AppData\Local\Temp\3f3e2091bca0dbd24954f6f3bdbb96dc9956d543f5e01481fb59ed607f6adfbf.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD538aa974eadc4b33fcc6711e375e04416
SHA1cc13dbf376dbf6cba3d859de2293eef71b87352e
SHA256f48aed868ec62c32d0fc60db96010db622e65b5df4f663646025e60554772faa
SHA5128fb97871b9fd766a573255c72a3c094cdc21d473f3a7967171ff1087dbc45c80799038b8dd12310ea91bd98a275a8cedc72954da87e2c60f3505e7835f96b7a0
-
Filesize
29KB
MD5fe3a9022ee54fe0185b939f0acd48953
SHA110f13ff9b8bfd090692ae40e202f07f02675cd98
SHA256e920fd0d14013b6ba68aba79a81b0e336bafe14a3331702a8f3fa125c97f4a3c
SHA51291a0529554b7c783b66f19938507809249abee4896b2264d4110db32a95f08ec8b49069dbb264dcf7661fcbf424eb6fc45db7dc7f9c7c4ef55cc28186fccf4bb
-
Filesize
320B
MD5b83cc88448d387f8037bbd1631531d87
SHA197bebfed90b77e74556c15c2fed96889bbd29862
SHA256bbec088d8c1b1e72e90014b64b989e432b427a2b045cf98f6939d888a3ed1143
SHA51262dc0d0e23cf91c678ecd62348165fd7992c7ef2b40d2b0be6d01c3c717e2ca7427f455859d46b178cdf56de01c771aadad0c48f0e7729b9d5f64ec09b4b99dd
-
Filesize
320B
MD5ac23e9b17ec0836322d04d17c4d4428f
SHA17179077300846b21c36530cd00e753e9443cf835
SHA2566d0d1fffa06940133e2ed77e4dba77c19ff5f052fc168836ea2327259c14f435
SHA51239647267206f32edc10bf9b5e708fa2426b8603d0af77ecb432ccb2b460ca658c51f866dc6d76058b843357e27b66e9af3558f456abb92073ad1841df4c2ba5a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB