Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 14:34
General
-
Target
8538b2f58e8c0b9e14192833661626032c0efa425eae8c967f660087be66ae6c.exe
-
Size
29KB
-
MD5
c2fe041f42002d1ea1b7665dfce0dbce
-
SHA1
0b70e37f58a158d166b0dc56fdcd690e1eef757c
-
SHA256
8538b2f58e8c0b9e14192833661626032c0efa425eae8c967f660087be66ae6c
-
SHA512
fdcc11ec9f25e9b2e7c765e519654b2903a5527e0d67170737688da2359822c6c4c49f9996ee59dd5529c065be16b5c158664525f90eac656d3013e34c809426
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/x:AEwVs+0jNDY1qi/qJ
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8538b2f58e8c0b9e14192833661626032c0efa425eae8c967f660087be66ae6c.exe"C:\Users\Admin\AppData\Local\Temp\8538b2f58e8c0b9e14192833661626032c0efa425eae8c967f660087be66ae6c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
313B
MD5ffb72ab4faba49ad441ce07db37dd8b6
SHA1194e13c1c32ebb6e7a1dc912261cbd58a82ff71e
SHA2567bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
SHA512517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257
-
Filesize
320B
MD501894d39b4de3abc5c1b9a91419e1fdd
SHA105fe0404af43b4fafe11e2af8d7ae14ea5a28ce7
SHA256a3031106e134afd1edb622a64c32e2746329cfa38e1d099218296b2a780aaeed
SHA51299339ad5cf6002c240549b28f355d06cc38ecbef3fd41a866d6217977d0746e8a7ec20916c6bcac9ba4e0dc33b1fce362dd73ab2e5b5beafae5165dea51ac49c
-
Filesize
29KB
MD58daa4093b00b74080bdc8711eadfb0d0
SHA1edb156a33c000a2eed2659905405f034d915765e
SHA2564d67a72df281fc320ebd04f6981ef8af96372fc1dc8e61cfcd73c4df14d3bdb1
SHA512a15919141c2154165c589e6f94da067fc9a32862fdb9e2612180c92691bec7b906f0031be7b4bab8433c10dcf693cf67eed2f7e9a31e7e348b9f840ddd81500b
-
Filesize
352B
MD5eeb7ba421d04705d5b07b77dfa0caff7
SHA17698b681a1bb8c04552b3ea91081cd2c9d938218
SHA2560671fe2b499b09370b75117e72ec6e13c9226d22a63f139079ceb1632559e713
SHA51223be1357e53031bd1350b620ab72d5630cc3cfec359d16f840a9d5920264ddbece7df8d119e95e4cde329a1c6e7d289aa83baadb52e6c638a94f9ce0ef5c0590
-
Filesize
352B
MD548675de24a3afba299cd52c56e7dfdf0
SHA1fa69a0ce99d3b3cc23abb208ce9ce6369ef2d7a2
SHA256c6ed5f60db0634ff4e80995cc582a62d5c3615d4168fc68fb3aad1154c627fac
SHA512c6b0876da318ffdc8928fb8e93aa6e2732d8635fb58b48a5bc4f63c10f6b96f613292cfa6a0086e85ae1e5c4ef900abc0fadcce6346493f488422c380479a780
-
Filesize
352B
MD5abb37b20c5a3b384ea5583de8863a399
SHA18eabb5ad9a219d55a73fc30ae69a304602d3352a
SHA256ceb0f76c1c4dbc260a000d92c4de80cc66e148614d40aab9bd66ef53ccfab6d4
SHA512cbdc20353981be0d748c7c7a8857ef945af1a7d43556b05692b68a6bc6c0106fe10e2d2b250243d56ab3711fa80b17fa5a91351e9e37b0d8f1a3791c172e8f05
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB