Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-01-2025 00:45
General
-
Target
81eeea10101289ceb641845aab171bcb0debec8935b32354408e98b1c2a9f9b6.exe
-
Size
29KB
-
MD5
c513405c54a42459e19f0f875f3943ae
-
SHA1
dd3ff5fe682a12b4544d9355707cbac137537905
-
SHA256
81eeea10101289ceb641845aab171bcb0debec8935b32354408e98b1c2a9f9b6
-
SHA512
c4dc689e5486a50acfe7dc995dd140ca6451e3fe9073c99a97a3d9e046667345c861fcdf36b6991cf44e02dc534528053c0901646569a8fbd768f1a0fc21e4a7
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ohp:AEwVs+0jNDY1qi/qGT
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81eeea10101289ceb641845aab171bcb0debec8935b32354408e98b1c2a9f9b6.exe"C:\Users\Admin\AppData\Local\Temp\81eeea10101289ceb641845aab171bcb0debec8935b32354408e98b1c2a9f9b6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD50972372d4c70a1ba634b7ae0f5a24198
SHA1fb728e32144819acb6e4944fcce02b24c120d59d
SHA25683e8c9f6f00aa4deaafcae4e150876071881f228a0a63ab80ed70b786fdbebfb
SHA51263f27da66fc2aeea90ae6d0ac33293103e3f950a2ee7ad3d133d4b23b79cc5e7fafdc29b503ba5d1d1b39e179a4bdb0976783bba17a959d690e07d4e5ac44df2
-
Filesize
320B
MD5e4367866ac4d905d5b27b6fe7d8ce075
SHA13a9f8083b839d521c9abae54844d9c01c1583100
SHA2562061d5701e09c67ab4c32089df69cac08fb43bae013f40e529c9ac35f1f0838b
SHA512a1ff99b8a48eb4e32a091bf44c912794088f00160a218f3f7116f9055f75e398b48f36bc663b3cb82aee55ab4bfd28f7b8eaaf09de36c1078a59d37672b38edc
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB