Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 01:48

General

  • Target

    a0dc5feca5fe89abc0de0ba5efa5a22c4e9ca2d7123668178154127e88791c14.exe

  • Size

    29KB

  • MD5

    29d3a3f10bca3e9e0727711688042e2a

  • SHA1

    5a4efc78dd80d5e0c928a390bc7a0031e140f745

  • SHA256

    a0dc5feca5fe89abc0de0ba5efa5a22c4e9ca2d7123668178154127e88791c14

  • SHA512

    7365ece13dc994c5f0c8fb4bdc5dbaf060ef586c862815c192cf35c37b844f74734ea8ab4212760da2a13baeafea184611f3d9fba33b9f267520f76be2de7df5

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/YhQ:AEwVs+0jNDY1qi/qgm

Malware Config

Signatures

  • Detects MyDoom family 7 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0dc5feca5fe89abc0de0ba5efa5a22c4e9ca2d7123668178154127e88791c14.exe
    "C:\Users\Admin\AppData\Local\Temp\a0dc5feca5fe89abc0de0ba5efa5a22c4e9ca2d7123668178154127e88791c14.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X3JA8BBM\search[1].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\tmp1D83.tmp

    Filesize

    29KB

    MD5

    cc538f62af7a949dd55923f4207f239c

    SHA1

    908eac77edf6fb1178f53f04751fa7bf02ff20cf

    SHA256

    ee70cc13d4d1d73ef3c4ef9eb0179e2e6e68fd6e790c8d15d32c2fd56a1f4eb7

    SHA512

    2cdd22264ba142bf028b5263913a96a632fb8490f4ab728682ef2bc6539697efffb4527652555089d55a90c6a676905b6a3aaf369d08d75cb514b0f3322b6fa4

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    210e307a6600395297e1c0966822970e

    SHA1

    96cdf38b91ef3e01dfbebbe15c901827de5a791a

    SHA256

    5ead1818178457e0aebaeb34f9e883ffed18ddcf89e30b0689fe227e88ea1896

    SHA512

    7c9f7c67bf4b90e4416dddf2d6e397036e92cd2bb6ee26c40e9dfdd55e84eb32ee1b70e603a4012434c0fa5a9e7dd1003d121754362dc393ff0d641b5d347329

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    98fb7169e5e78ddb249d2cd0ee0bfa82

    SHA1

    ef94a5f3a8167d8ec750f22a8ff20c555a855f4f

    SHA256

    48ae360921bf2b86c52e0f6936c1b3a1446972fa8b609556857906c0ee049410

    SHA512

    8e4e068d4b2b9b0ca3949af066ab337be7f9241b6b3390146f3932d64155665cd7c84d3ea491597c1b1cce10177e292bfb4073b81dc5e48adac20454c4bd87d5

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/3940-175-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-168-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-133-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-44-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-204-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3940-49-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/5056-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-134-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-169-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-174-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-176-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-205-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB