Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 10:53
General
-
Target
6fb00c4ab8dc94f0105527a0d9f5cc48a5f474544410fadb46054d93d6627ad3N.exe
-
Size
29KB
-
MD5
d32649b8d0ed4f7ecd2d252483d4f520
-
SHA1
cd44817096c77eef6d91af99e703e0543f6edcd4
-
SHA256
6fb00c4ab8dc94f0105527a0d9f5cc48a5f474544410fadb46054d93d6627ad3
-
SHA512
9a52e8cf67339781ee47d3617624cfd4370c6289f2c28e1bdf3da5aee65128c29b0fd2626d80ae60aa1bcae3923ca2e179b30b300e121c2e12ca9b439a7aeb5d
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/F:AEwVs+0jNDY1qi/qt
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fb00c4ab8dc94f0105527a0d9f5cc48a5f474544410fadb46054d93d6627ad3N.exe"C:\Users\Admin\AppData\Local\Temp\6fb00c4ab8dc94f0105527a0d9f5cc48a5f474544410fadb46054d93d6627ad3N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
320B
MD5816e3987a7047c08e07edd750c3fcb0c
SHA1d545a86d564a38719b4b4ea852418ec1295d8982
SHA25689c6d95daf8f2f48e0f44621579d27ae14aee7c9e6adc16f9da3e76af2f787da
SHA51293dca91240a880edee67823e46bce91a43bb6281c7dfa0d0c4064fcc4d775b819ccce2728a3e2e893c92d53d1a40b4389aaedbba880d1d5b7125e042c9b88a86
-
Filesize
29KB
MD509a34e3d8070ceca81cb5dab8ff1bf04
SHA1c3b89d7d5f0e72a2fd107a3856b1784c92f71d83
SHA2562256446e251ac2e2d45dbba91f9641849ed98275c2648ffc639881552f6f86c1
SHA512cbb8670fe6c5bd400e724e99ef1b2aae68d5378eb4b6fee126d5c58072e5c6e5c3f449fa127c272b5c440e644a5ffaef1ec584831e0260324663b5eaa7118609
-
Filesize
352B
MD5354e5873fab5fda75fd85e762f7c1a1f
SHA1b6ebbd4cabdbdc07fc1d9d46ae6b871858349608
SHA256d81134b7f103a07b1988cd674081c1e7931f856b1da26501aff96b96f134aed4
SHA512f93b12b89a5abae9239130771163d1e6adc08a4b7876fddf61b8afb6d72c0803c0085f129be3d31aff54474d1d01b020a11498d9d68f0d02b9effce669ada836
-
Filesize
352B
MD5d924d0e58061bd3404f72b80922a1e97
SHA170ad743b5a5b269a15012f39d3b3bee7ce6bb399
SHA2562198b64d7fba92321588f3f6c21e6cc544209c761d287f74b4961db5af55fde9
SHA5129c214e9e4972d46cca02658e31162770c02939cd061798c252d14999963dbb34e35e6f3c327abc30a4dd8ad09d3080e5745bcfef693dc482742d6ab70bf9c014
-
Filesize
352B
MD53fe04d4ac441468921becc7059a70566
SHA1ea6e3f2910c268fbb117f83031c109972190131c
SHA25665549e3ff3e54fba10f50a82244403fa2c8e74ee6e86aa8c9e1337f7ffc216a4
SHA512d386dc80783691ead90eae2aacf8531d9b718b9e9596b98b3e6a626d34335cc29344133441603985b776d7507c69e1b82a537a53bc3053d3b2a9e2d5a55d3de3
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB