Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 07:58
General
-
Target
79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe
-
Size
29KB
-
MD5
335df5643aa81b31621fffcc838dd8ba
-
SHA1
a640cd7245aaa1292092996430ff4a614bffd8b9
-
SHA256
79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e
-
SHA512
2ed9e3098012c88401e66a5c237d1275a63b889ae4928e916901176bafb9484922f193ed564535f166d6bce82c2b2f8e26e51764e7216091f4c8469181dd9bd7
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/hQh5:AEwVs+0jNDY1qi/qZQj
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe"C:\Users\Admin\AppData\Local\Temp\79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD500b42d62766f61034b544be58674b2d6
SHA12bb79097c5635b0c9a39bfc868790e4855f9381f
SHA2568984b9ca63f439efcfee27144ff1e0096ffe3add7ce5e8301c3b68c9c5e2b33a
SHA512532f04c57054a5657c6dd7de5c303f5794cba4d093e72abeb53a2929ace64a53a44d4e16e2122fed6a2df9216a4cbcc7140acdbed84f0291c6e86c6f9b5c5b3a
-
Filesize
320B
MD5b30ffa06d90b6b5c8817e4a69c42206d
SHA14e7b7770061d8620394727dcfc5c5b53420e0a13
SHA25634df26891d0c8006b9e15ebbad57405ba46f86e25f29dfa42e85f287218cdc61
SHA512a785bf30c559d362a660dc38919be9f83971dcda14eca5c0e3070df61e43b18f5668cd11806aba13bab15e5ce01a9e082f403caa4a2aaeae927d60b050b442b0
-
Filesize
320B
MD54bb8a58b50409248cb291e69498d31b0
SHA1708a2a8e995008ace5d187d560048d185f9bf707
SHA2561a1a28d22d415f1824f82292d587a9984eadd30305e410987ffbec2665826aa6
SHA51242942c897adedb23dce622a30a165f37b1ccf3f1d2f4f0c4a909e7c0cb6e6108a4475fddf61efdae089b94117e3421d1253ff5408a8d07a5f912ee96c90961d7
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB