Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 23:03
General
-
Target
65b84c2fb7fa179cc7be8e398d67f19e65b305b7fc407a82f92b6dd2bb927072.exe
-
Size
29KB
-
MD5
1563518c9fd745229694102f55277b02
-
SHA1
b7ee1df8030d6b930705be1229df71c1ff81d7d6
-
SHA256
65b84c2fb7fa179cc7be8e398d67f19e65b305b7fc407a82f92b6dd2bb927072
-
SHA512
cff97307fa4091a62f21884a6715478c3b99342e2200688a605dd81d6688a135411a83e9683b49172186c1ec30cbb199766c0b1a8d7f002051d463224f8f8a7a
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/y:AEwVs+0jNDY1qi/qq
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65b84c2fb7fa179cc7be8e398d67f19e65b305b7fc407a82f92b6dd2bb927072.exe"C:\Users\Admin\AppData\Local\Temp\65b84c2fb7fa179cc7be8e398d67f19e65b305b7fc407a82f92b6dd2bb927072.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5e4bab34bd8375e7c1c31e2df2929e005
SHA1a6cf97b904a8aede5572de51543cf66d81a29929
SHA2567d1ad3f474d30037f35e28c02fe8d457f60c41f175480f65539885c0ecc67597
SHA512f584128c9a77f9dc51a3c3f17497c29bcbfa25bbd6115abd5a421ff151797d6286194a8498ed35e7a99bafebcfcd682e571c6465dad69c701f9b53b90e8d8b1b
-
Filesize
320B
MD583991ecfdad60ed0124055547f4b4a77
SHA1a37bf83fdddfb834c04c6cd7a2a84868da0e5d29
SHA256d7f39471ee36570467440a23410fed96df4b2252d4c5b514f0b0e5b009f01f02
SHA512fdd379cf4d63756e74d8b90ac90f4d758366a1ab19ccbe9390f35fecf532bf42528ba020c924168eb4970d07b88779bd974ac3687ab5b78db5f6730da54358c4
-
Filesize
320B
MD54b537e9d15846f95225b2f061f5e3672
SHA1a4a60cdfaddf02f16f3e6e07d7c888d00bc8581e
SHA25647ec2a47ec6bded1c9096c0542a7133f49f38ee7d082fe50c33864029b453ed9
SHA512f44809c45e80d70c8081d60a40eebdeb9dc89717bebae4facf7b2b96bcfdb10f89ad1e3bc5207241a31603fba27504f8d4e614373e5a68e4f31b213d74ef4fcf
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB