Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 00:06
General
-
Target
849d52b70c3dbd7e2db58b419e84a2f3a5190674030715bd08c1237dce5cdb6e.exe
-
Size
29KB
-
MD5
42750984bdadb7810864e98fa966cac2
-
SHA1
5a695c23bc61263f66a387c37bffb1af692b4531
-
SHA256
849d52b70c3dbd7e2db58b419e84a2f3a5190674030715bd08c1237dce5cdb6e
-
SHA512
c33498ebfd215ed4518d29d41cd31ed727d3e33acf28909a2e98e44fab270860b2b3d29a2c55315f288da1c965b7d77829d235cf942ec52025681c9b48e8816e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/BhQ:AEwVs+0jNDY1qi/qpm
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\849d52b70c3dbd7e2db58b419e84a2f3a5190674030715bd08c1237dce5cdb6e.exe"C:\Users\Admin\AppData\Local\Temp\849d52b70c3dbd7e2db58b419e84a2f3a5190674030715bd08c1237dce5cdb6e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD512a806d11fef04d328c840220c0eded4
SHA1c1514488ad05e2f6edd8f6e313de66451364f6f6
SHA2568f67f0578476271ad80b77ff8f83265665059687cd7072b399091c0a7705fa79
SHA5125b15fbb57dd0926dd0883ac3f2454e12a9ade27707c626ac11929b87fc2ed81c14e83f56ccbada6c737fbe080a8d24ec1e44c672c225d9cb86f4e8b4e35f5af7
-
Filesize
320B
MD57f081b0ec57967ffbf1f552ad5b4a8fc
SHA1590e8e63de9b98c5b5aab93ba7360e31ad906f76
SHA256679f0d208d6ef2129b52dc1763a5aa947ee7fcd3a5aab26e67274e8e14cd17c6
SHA512d4837e705d843427f87f485608bfb00b2beb74db95a04531e55b649eabf803d258c822c28928f36038983a688f72179c854d24e8e4bfa451cdbfdad10d9886fc
-
Filesize
320B
MD5ac2b7abc047b7e99c22fbbee56fcefb0
SHA1459b7c96eff37ed3a6f806ae22975866ab5be65d
SHA256870ce3a4a57274782a3033e07afc327736eaefcd3015ac226761d3c5511f260f
SHA51256dfd367a2f685173918552614b4d24ca56767fba7ab1626464c5845fbbb03b21d29072bc5e0a17c305dd2e343c26b093944d0fe6b8ea7033b3cce61d18a98a0
-
Filesize
320B
MD508666cd8c9c8375e3b31858f893c2c5c
SHA1ad57917aead4f77ade7c04b3341b8a692458c17e
SHA256ff9fe648ae398650a92adaff4d56ea03eb61fdf8c5b2adc4572edbfa385e9271
SHA5128f187a1d144d7b857425ebb6367ddedaea098a88b3da4e64fdef37632e59d340c65cca3d4d5697004f3eea1537b8284bd1ec954c18c5c311d76b3ddea87e97cc
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB