Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-12-2024 20:07
General
-
Target
182a00708fd6da66bd146294d791d9507ceb70b3a871da8dfc4aacb29c15d171.exe
-
Size
29KB
-
MD5
65a8c70b2b01aec04202ea60dd58c4df
-
SHA1
bdf663c0323da0c2c0555c20ad3a72e27d7fe68d
-
SHA256
182a00708fd6da66bd146294d791d9507ceb70b3a871da8dfc4aacb29c15d171
-
SHA512
e0af870567d09706b12c75aee336d0952b49848445baae6acced364e1bd7b1b4ab5429bee5fb621e667564128165ae5414c79311e341b5d0747737ea3c217188
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/shP:AEwVs+0jNDY1qi/q05
Malware Config
Signatures
-
Detects MyDoom family 11 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\182a00708fd6da66bd146294d791d9507ceb70b3a871da8dfc4aacb29c15d171.exe"C:\Users\Admin\AppData\Local\Temp\182a00708fd6da66bd146294d791d9507ceb70b3a871da8dfc4aacb29c15d171.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5434cdcfda8c47d4fa4a9cd0d6c091793
SHA18a7620024bb2e70a6c7da199945d06e59ac655f1
SHA25674c72690879e6a733269cc767860ac4cfe2e68896e10ac3bbf829ca158dcb533
SHA5123be180abc439ee53788ac090a426a8e6db3de6a29698584e9523bdffbc712ddf6e1481d6ba09dc5ac8f13fce75008517f1280cc465e13639b89d79463d2a2a5b
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5f46505d1d4e3974bec04d250ef03e4cb
SHA1615cd9ee3524af25f542ebabb9043c779c9b1991
SHA256b52cbeaa09fe93d8f11ce6fa93725a85b08ae7fd3b0f56f440b31883877b6912
SHA5122272265b5ca7a1894ed8a6c2db0b4ce1a3d578694e650e79aff2a8b6419278180fe3a9b5622ffc4031218d9931e8b9b4fcc40a5f7e8d87768c8d21c51ece1599
-
Filesize
320B
MD545b442b4a440dcf840b922e92848a57a
SHA1299aa39b5c5ac40681bf84eb586169809d2682eb
SHA256f638dddaf9a6af22cff42972618d66344024193d64d625b1a1a00f4f4af86b09
SHA5126061445421e63717aa97ac4129d719965ad54fbdb80182907e55c4db352396f5589470f86e45ed7c83517d64f4665b48472abf1015627c8ec9fbb01332a198ab
-
Filesize
320B
MD5bd4e2372a57d606b3c456ad2d8b8e2f9
SHA13f4aecf5631fa1b7a71038394cd2722d09473649
SHA256887a44fb07f0efeb6b9070bf1a6132cb2915d81b428fceeb97c30322986209de
SHA512d247a5df16198b1c6f2a5df35071e50d8e2aea2597fb629e2b32e9cb62d8210fb907ce180f8f76a37e4d64d1dc3c8dd5b822cd2c076a1cde2e48fa3eac4a6fa6
-
Filesize
320B
MD5d63a6c792c5c691c29bec2891ad09f6b
SHA1b7820be5052eee74775acf8138a5b63a2c5f23d0
SHA2561ecc3a3bd28121c063bf62c158b64b20eedf2bb4e23af657ed0521634607b23d
SHA51258c89f7475afb5a80682d457f4dd85be9aed3f46aa8e0bdbbed2d0d774dd624d9159cb410d475574e375f119093efe0fba54e06b4afc1fb039fd339dd81ee385
-
Filesize
320B
MD5bdee27819318b82a6b5de33b533221a2
SHA157cbc14956e158d74a28da593b278b8b16272892
SHA25653bad5094c36c7e57dc3110a94a6fd24c67289c0787d7dac847645228063158d
SHA512ceeaab861ad17ff2ea99b8dd15d83eb4eaae907689dc5c996e297f1e5d3e95a8ac1f4238f2492d00cdd199099dcdeae1d2e9673662ff9b0cdb244cd9573e916d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB