Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 15:05
General
-
Target
8d5025949802f1ad18e7db87782a5f58322ba1e67af09223abe8de85c6da5e3cN.exe
-
Size
29KB
-
MD5
d3db2513ac00ca182b3b40e005c94a10
-
SHA1
6adda5ffb11cf02ee044c899e5ff8f9a1f8f5419
-
SHA256
8d5025949802f1ad18e7db87782a5f58322ba1e67af09223abe8de85c6da5e3c
-
SHA512
e0a4df6c6dfd3aa3e5838005c59e3087fd47dc0f00493a10f9fe8c14831e364b66c15f6929613a5538ea49cf227daa05005391f52afbeccc377250974042eac5
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/qh3:AEwVs+0jNDY1qi/qiV
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d5025949802f1ad18e7db87782a5f58322ba1e67af09223abe8de85c6da5e3cN.exe"C:\Users\Admin\AppData\Local\Temp\8d5025949802f1ad18e7db87782a5f58322ba1e67af09223abe8de85c6da5e3cN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5ac648ae7ff1f9ab3527bed02a8e3b9fe
SHA1edec05310aa907ef226fd089e4d4f3e256b21171
SHA2562a5da0d6822c0a851a1df60a1d5c558025893fd3632ba8257b6df3dc7681edf7
SHA512f15f39f83e59d89d5571108758b8b12ea2457e1e1127632ce97f5bba6178ec9760d420c77cede96055096d911210b5361f89b087b1f17903350b2067d81c9dcb
-
Filesize
320B
MD5485d6cfe9846ac77415985d407e69c10
SHA18d13e5e49015d19a5dc5934f30a3e538b990a55d
SHA256b6e1ebb8e9d227bd4a14f17e42de58a47dd585e00a7fd2e6099dee678c5c8276
SHA512779de89cd8064493a49f252b2bd30cab1a9948fdd70ef8c8d563704d2c1782e218986613086dcf994c90b653d776807ee9f9501c0c828df3e695fd73ecfbfc26
-
Filesize
320B
MD53de4bf198b1f24bd126ac81a4a88bbb4
SHA1a6a2dd2522fe7b213a68e9ab3eaa166dc77dbe12
SHA256351adc6cf19de8ffadc8a130129c1a2edf77e2b1bcacaac02e07fcffa6b09077
SHA51299e53df6354da888d1b0502659273e13317bacbeaa52fd8d0a40d11a21f0acb55aed4933508f6c11a1044f9231abb4d6166a06d7f0676e731b48487011116aa6
-
Filesize
320B
MD5103ff96891d4cce058b2d5f75194c9ed
SHA149af46303ed60d641c6561333401c0f4795cc06b
SHA2564a54d9154f7ce6c1d207cb2c84c893a6851376baa90a9c9a4367424ff8a2d624
SHA51275adfce4c0d4477455e9e871c88daa57cba1af16008dcbf6e8cf9927e2d14f608888052912999f19ad0a65c433af712090c696b89b42b19dd07eaba128281908
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB