Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 20:40
General
-
Target
28c82aff2b40d3395f3d7d62814a687e6d960033ff44572b0a259dc412261986.exe
-
Size
29KB
-
MD5
73f3a9b657ecae7ff79baabf54c8c38b
-
SHA1
caa538f7cb53ecb180def5cea2ec1d8fe6efff1a
-
SHA256
28c82aff2b40d3395f3d7d62814a687e6d960033ff44572b0a259dc412261986
-
SHA512
154d87f979d5776a53d5fc3d69aada9773c9ad4463bb39beb2a1b68e6374520269f5f46d1bde73d470f60da3bbce9d9460c5dd5e5b581dae690316296e080957
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Chp:AEwVs+0jNDY1qi/qaT
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28c82aff2b40d3395f3d7d62814a687e6d960033ff44572b0a259dc412261986.exe"C:\Users\Admin\AppData\Local\Temp\28c82aff2b40d3395f3d7d62814a687e6d960033ff44572b0a259dc412261986.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
29KB
MD51947d27aff27e5cbf84c4da43b618948
SHA18976dd38a6a3eff76e7c5fc1da99164ade0621bc
SHA2564dd14b89818f5d70fc1a1969f5689812857d8cbe9000e03df8d9b779d85d93c2
SHA51265ae34bf5dd152fed04e1107268fc0b556ba3952c591faadf72d2935baeb86aa9b683d3b48f57cde542326affdcf9c47d6236098578ad6dd8eb613270fa9c561
-
Filesize
320B
MD53dbf4ba146ed89e028e9d0267aa847db
SHA163123928270065c9a554e25cfd05795b9b53f3d8
SHA25635b92fe369352ad3226d1179225a20a71a75a4dda355872a88707f1600e53374
SHA5124367506e4e7f233ee57d18223a5933c9b908ec76b6adff34d192fd1c48c5633cf8d2c1490a53cafe7489088ee4a8615ef5642971ebd480ab7a36c3c249742953
-
Filesize
320B
MD5fd2dee0857832b76ee2a77456e94688c
SHA10eb415844cc252d6ada7274af393a6ab25273349
SHA256377ea6ff406f61a04e6e5f0ff98034dd21f95aa0fed65ca0c6cc7686c198a2ec
SHA512429352d44751a57fc815fb70f5cae9412bde82be1c2efab19e461e87c5ff3d6917c79a3cc78b8f9ee89e748a6391baaf15c8d794afd24ae2d02f242e32b20edf
-
Filesize
320B
MD57ceb21c74c40922891c1fcdb051d0866
SHA118288f01f0ee7f7a141028180deedc2e9aefa29b
SHA2561aee57703b99ac0bd1a6d6ab68e3f903f5c2ac7cb5eba802b674f9071785760e
SHA512b7d1114abc912d7f10f777e7b7a37abf1da0b2f4409e5501ee2bedd15b176308b1c0e6c54e52e7dcc5440dc3111bf9a47fcecc6134314dd4ac7ec8ce5845b972
-
Filesize
320B
MD541cb507b47eb1ecc6aeca74fb0730e66
SHA1948a9bb4543f40a3ab3785c1c66768f3b74b44e3
SHA25641bc1bcbffe35abdf957ae8e628370479e3e8695fe67b780d5eebc2aa498c2e8
SHA5126b05e07565a8e97d01d952318ef644c6b1bd027c84bae38edd67b622d7fae819cb0b6427449e05e702f157ad4089e5cfba90887a5764464fdd05e31d652fec56
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB