Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-12-2024 14:43
General
-
Target
027c3d13bd5381fff17ad6d43b5b7d6b9d35c6dd4501a342520cb839fb0a5a81.exe
-
Size
29KB
-
MD5
3fca3af6921ad52fc013177775820581
-
SHA1
8f0e7503a7a7cd3f1e4a207acc5ae489174355b7
-
SHA256
027c3d13bd5381fff17ad6d43b5b7d6b9d35c6dd4501a342520cb839fb0a5a81
-
SHA512
552f11ed8204f164726700695aa97cc1f6103c40d422f92228e380567e5b210c1953f129b908167c4e2221d2da6f237c95d7b766e7bc4f64ada309c19c392379
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/zhs:AEwVs+0jNDY1qi/q7+
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\027c3d13bd5381fff17ad6d43b5b7d6b9d35c6dd4501a342520cb839fb0a5a81.exe"C:\Users\Admin\AppData\Local\Temp\027c3d13bd5381fff17ad6d43b5b7d6b9d35c6dd4501a342520cb839fb0a5a81.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD540d7df31c8989d061b23bb2bed14678c
SHA108b673b290f2d430fec857f55ac324133bb8751f
SHA256f9e259edf065f76d3de7435d393a5f65edae9fc4bf2aa2eb6509196d5c4b5b86
SHA5124f8dea817ed13b7e62f7c0e66d93a6ef745b81fff0c115552e538787feef455472a01b14a263217acb13ed0af0714629a4e7abcf3c7a098237026f122c9ee03c
-
Filesize
320B
MD5f3ca2cb19adc75ff38ac401519511211
SHA14a8c166c26225afa4f9ede64ab8994aa1d2909bf
SHA2561471e075291e3d1e4c5ce7ff8821528ec4fb21888ec34c99bd3a30db3673a6ea
SHA512927fdffd6461fc5e95775d14bc1ca19b99ca3859b5f86964c25464e002fc66be4a9cb81fca9108b5c5fbdb3e3afc69731443ed9b246a0b6c484d8dc99a04862c
-
Filesize
320B
MD50d9964f0056b063a1368a14fb642c6f4
SHA1867053db11f6700327f9ca360d5d9539b783fdeb
SHA256c79686d9ba231d555daf32d5beb26f2bf772de02caa9bd3a92ab71c2d0eb5093
SHA5123f4ab8911d2efb96eb3c09b98dbdc038d5acee20c9938a5b7f59604c25ff1a9aeedc4a252eb9c5a573107eb3a29236735b23f930db0dcfb616c926cc461e668e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB