Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 05:17
General
-
Target
54d062e43f0760a3709b5e08bf86a0b08b08048b4d2d0996e70029ad6b87107eN.exe
-
Size
29KB
-
MD5
30e6c402f288ec8114b1560ecef2ef90
-
SHA1
240cf772e935a02ef9e91c48a9b5a14bd0bc4411
-
SHA256
54d062e43f0760a3709b5e08bf86a0b08b08048b4d2d0996e70029ad6b87107e
-
SHA512
da5d2a4250ffafc53ad071e656384f6923ff8580c8146df5065eb72aa35d1a85d738efb28f0923c04736549eec555f8d54fcb4725e103926d777f2f91bc2fbb4
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ohp:AEwVs+0jNDY1qi/qGT
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d062e43f0760a3709b5e08bf86a0b08b08048b4d2d0996e70029ad6b87107eN.exe"C:\Users\Admin\AppData\Local\Temp\54d062e43f0760a3709b5e08bf86a0b08b08048b4d2d0996e70029ad6b87107eN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5434bd4e7ce3fc17da003ea819ce962cf
SHA150f872af9a6510c051f886795146a7cdd028d3f5
SHA256df7a86dda592cca6f3b0ea50f11c0a300dc306013ad4f8fceb987a9752e3551e
SHA5129666a4be94f0bc0af6c065ae40f8678874ad88612d28129b0faed3b6fa823e433cf8dcb524f7f2f646f995232ae5e112e0eb8bda187efcef5efd5165c4da5968
-
Filesize
320B
MD5a4439a9d8c8e91e70b5dfb94d589c813
SHA18323018075c10d5e0ca6c2276ee144f62722d682
SHA2562972eb7a3d3122ab3d063f0c31833b52338709ff3d198ef0138f9ddadc12bdd4
SHA5120c047925dd6c7379c4139f7c5994294ae0a528d58804b0f012f1367f125cb2ce63e32ab5d6c3e4962ba372b11978357eff487f4e045b90e70a80d55e2e8a3adc
-
Filesize
320B
MD513d84c34393e6f91cfd87375c7c176a6
SHA116e5bca20a61fd01bf7e3f54fb4264a39fa327f5
SHA256978c3595eb22950acfb6418d1444c3c452ce3bfb4194c8fd79917ecf1e9a707f
SHA512cbed0341ef0fca29658a9f15312470aa97888466839054e3f7b767958fc35a55d59f5dc128e168f78297cbdc21a8eae84be3e3962c64b0ff6b1dd40c258a3812
-
Filesize
320B
MD54cd75ad599a6c7cbe032f454abf69ad5
SHA18dae43e75070d4014a0bfd7c188a134dc549b725
SHA256dd09e2f863133b74c88ad96c0563503dd91a29b4ae8fcd34a261a752d055da26
SHA512a635908f8e4e26a90cfdee8e22d1a3c157e8665f1074e8b91c4ca4c07fc098c0fd706dd73af43c73843e468c1868aef3cc97005a9cae4fa6dd29d5ee3365e61f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB