Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-01-2025 21:47
General
-
Target
3762c050e4a4c9a0d609924a99edaaf08e47ae5e26904de8a2a7f836e9c03209.exe
-
Size
29KB
-
MD5
2722eb2b49d762245faf922d9999a5f6
-
SHA1
63a6a706a86f381b2ae82785195b0da19b4d4d0a
-
SHA256
3762c050e4a4c9a0d609924a99edaaf08e47ae5e26904de8a2a7f836e9c03209
-
SHA512
d219c349c9e1880f18e21e789f7faea70496177021c8d44a6b5cf61225b81448aaf0636fd3d37327906052014ad9ec9252c39b31a3a0d7d7885bba6eff14ac24
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ghp:AEwVs+0jNDY1qi/q4T
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3762c050e4a4c9a0d609924a99edaaf08e47ae5e26904de8a2a7f836e9c03209.exe"C:\Users\Admin\AppData\Local\Temp\3762c050e4a4c9a0d609924a99edaaf08e47ae5e26904de8a2a7f836e9c03209.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD500a43d74e28287fffc57647e0df123fe
SHA113f975cbab7c4cd21cac9c11c093b7ae2544d34d
SHA256593384c14bff82dfdb0a36c791d50bd294403d302f986b55e8506dba900467ce
SHA5124b45f4d036c522f3a6c413dcd32054a161b0581df1568ee634df6ed50c1b23f3d229e86cfeb156c4607ee3fa6897c14048a11d41ef1e621c76465de1c03f5457
-
Filesize
320B
MD5d81947e286729de252238ddccb2e4396
SHA1146afa37c029769cdadea3770bc9d2e31045d88f
SHA25659eea13894092a647b88a233510f1584daf4e1762d7f71a27b26fe8024e6558d
SHA5127429abc64824178269d6c95ec8059d7e0ea3d58b2606ec716ea5461005a90161bcc9e75a951367c694137921425203e8e544c1bacd44344f4f0617056ee26428
-
Filesize
320B
MD5d5c200cd8dfabf294b5552a81163e76c
SHA1aecc67729c02da69ce8225b15ebead2d99eb4644
SHA256e82a63361540801dc60a15cde9ebe03f005d8c1ff5e1aabaca705255d1aff6f2
SHA512069a2d65e99c8502a963f4126659761ba20e1c6d7456ed9cc764c4041c2402ba55d6828c295224dfc0bbd0f380d8ff9889bad6761689fa33384f324dd8526b70
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB