Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 04:39
General
-
Target
e36ad538006f6abd2b4d5aeb3a0897a9e1300b5b6cb72d9528ba55118fa3462d.exe
-
Size
29KB
-
MD5
6920cfe6f1132b75ed112040b877bf37
-
SHA1
aed14e05b3f5cb0abf8ac7f2c88d59965f00bfd3
-
SHA256
e36ad538006f6abd2b4d5aeb3a0897a9e1300b5b6cb72d9528ba55118fa3462d
-
SHA512
08364dcab92bf3f99fc70a566ef96188f6fb0a33d5f43d052963a663f6e0088326bfff7a12db72fefd29af4537c89c87762d81b83a4b93ac04a03085ddd82244
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/bhP:AEwVs+0jNDY1qi/qD5
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36ad538006f6abd2b4d5aeb3a0897a9e1300b5b6cb72d9528ba55118fa3462d.exe"C:\Users\Admin\AppData\Local\Temp\e36ad538006f6abd2b4d5aeb3a0897a9e1300b5b6cb72d9528ba55118fa3462d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5bcee86eadf7a05e5690280bac56b5cfa
SHA1039329e16a2062b6bc9f6855556213ca05c4e776
SHA256eafbcc361879c4de90ab7bc80832962a915562edffe308fdd4237b6760a81615
SHA512c981c1ca582639aabf3d92e51ca648fe9b4acb41966a69df5d733da2298f88c9b574fb660d7d0d38d03dc964341308b45157ed1dc9aa955edaacfdaf31358932
-
Filesize
320B
MD5120d058c84a7b793173368d1179a5614
SHA17db5b36c86348808488ab7fbe263f01bc9e5cdd3
SHA2566f52e15ec5668bcb1bf4a7ce238819f5f5781bf977b24b2b7c7ebaf987a25c79
SHA512e603ffc0ae9bbb5f2d50feafc24c68aaf4b57120ef0a6f4347066c92c47c914b11cc80143660a95d2ed3c5da4ad325662d61ea0938b39896f1abfd3615eb1af5
-
Filesize
320B
MD540d3b9045827f6329673bb20a8f5edeb
SHA1c265b16936157d4abc63c04717e6ca06de257ad7
SHA25642b7487acfb4302c443d0130cd1ac20bf3b104424d78b1a35138a304d22082c5
SHA5123a823dea12180d73d4ae3624783ce48ac06ae9d887773c585438640c641564a18c29b66e61e7f8d25f19f49aab2af4d3a525a753d77d7f1a8a58b3a7d5ab0c9e
-
Filesize
320B
MD51bfccf2ca3ec556c63e539a1721d69b9
SHA17e55f62d1129ac5e5caaf306a7cca37d60d60938
SHA256285948b52d4516c3be13c778e5ca26f7b9a874b1c30dac84c3cc6bb262b9db79
SHA512baacdc70055c25bf69b065c6735989694c94a9f53084bb7fcbeb00ad5533b407f77bab77fba152bea0c986e3708b39b6cee8765dbfe67e1d09a669a9963b2469
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB