Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 20:15
General
-
Target
135ea0ffe35cc187d3cafcd8da15808ccf1558fdfe9893c1578b68cc16cc72b7N.exe
-
Size
29KB
-
MD5
fa1f77c78a181c7195d5c401d02355d0
-
SHA1
deca9d9f06260fca593c154a98380386b3df22a3
-
SHA256
135ea0ffe35cc187d3cafcd8da15808ccf1558fdfe9893c1578b68cc16cc72b7
-
SHA512
716cd24499e4cef48cac7997f0027a1d582fffff9521073143204ce1a13b52f7f039e9933670dbc943199bb29c55c748083535904f16786cba2ce8f38fa172cc
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Hhd:AEwVs+0jNDY1qi/qPH
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\135ea0ffe35cc187d3cafcd8da15808ccf1558fdfe9893c1578b68cc16cc72b7N.exe"C:\Users\Admin\AppData\Local\Temp\135ea0ffe35cc187d3cafcd8da15808ccf1558fdfe9893c1578b68cc16cc72b7N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5de355d79055c6169f9c8bffffb24c1ae
SHA127716c2b27905cd922ce8da4a1a42f1f9e8f88ee
SHA256f8ec4e2ead1ebea1a197a2bde836f19c6d49d83c86ff88616a4b68987fdafe37
SHA512660cec21f7243fac3238d9be65a0bfaef2887fcc25eb7d35bf074eb2c5d2013032f8254b8935c91fe2e6350d93be8eaf011c7a411b80ba3cf020b99c41612f57
-
Filesize
320B
MD5a8afff2eaa316a03b331b88e4ab7b4d5
SHA1b0ea76ec08a6778166bd61477d3c0e7fd38fabea
SHA256303c518470010295bca610dc68d164fba5e1cd75e8fce0a17f232a5e4afcf3fa
SHA5128340156ce3376f8ad34753296b923f4165afaa2578cded06b645fb8840f92b7af074377ff1a5decb3b01a3ff4659fee1bc38e337b934bc4d5402cd9fc9489ce8
-
Filesize
320B
MD54d98f5a57f156df1803c71ebef475d05
SHA16cc65792f22df92e89a2b587c7ef69f1da413d6b
SHA2569eacdc0faa36471e35dd686b8af58698a13b50033330ddc810e031768aab6759
SHA51282d9b29d647930ccc2da1951fb73884b82f5c392d5f9362cfb1c530ff0d4c93686473c9a6b2ca6d35950c99a6deaaa1882cac387258876d3ff0a7b52ac4f529f
-
Filesize
320B
MD5f6f7cb218f03af03835f10e0bde1a93c
SHA1a377442758110c493d7a17dfc905ccacf8299ff4
SHA25637568c1bc4281e1067ed405926b1b43dde9e30923fb92b3bc5b5c016e4028964
SHA5126b9ec07ee9667fbfe21fb80c231271f2f101954964a905296c8cf9956ba1ae454d9a38651b25e58ae80083dbc1f8fab192df7554dee15afd4157ce2b777a2b35
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB