Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 21:21
General
-
Target
22dcbae08ee196439a1d4253ee3576d9974a3bce13b7b87fc4aa739c4bcfd654.exe
-
Size
29KB
-
MD5
90b643beac1fded1122f0fe20639e602
-
SHA1
3c2bc8e2dade5394f97bd2b6d1e79766e66e4531
-
SHA256
22dcbae08ee196439a1d4253ee3576d9974a3bce13b7b87fc4aa739c4bcfd654
-
SHA512
cda0118b7e7565ae276d893b9841d69a3ef8f8b0288964e6497d2d32123ce58edd7f1d37e195ee124e5773b1f95c3cdd53a8c0494dc8711eee27e2bc42a7e383
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/yP:AEwVs+0jNDY1qi/qO
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22dcbae08ee196439a1d4253ee3576d9974a3bce13b7b87fc4aa739c4bcfd654.exe"C:\Users\Admin\AppData\Local\Temp\22dcbae08ee196439a1d4253ee3576d9974a3bce13b7b87fc4aa739c4bcfd654.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304B
MD5cde2c6ec81201bdd39579745c69d502f
SHA1e025748a7d4361b2803140ed0f0abda1797f5388
SHA256a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD58cbe9df1cd339d353bc1b3da2f8f0a0f
SHA1210f0338b3749aebe358488977e3d39a9c2849c0
SHA256f3372fc04f095b1d5e31683e4092ae84b0cd3396ffed4fca9bba6b218ffeaf56
SHA5127f7d0ac58aca54d96783d27d7065390854b7e7442dc2330de6a0b5d80a2c413043e53ee5106e1349e5c83ddd308bc689c8a9b46979f121e05f2bd5b2475cecb1
-
Filesize
352B
MD5a8b3251e306d4c9a7e743e0e862a5176
SHA1035b1973e96241b390d5d81a031655a143364394
SHA2564f0e79cb47db6cd3fa2ebf3234445e58634b24178c1c6423044112c244d35c49
SHA512eb9972b89aeb37a1f4101c61aa8b845f49a31683ad2bbd509163c98b5ba98246f48d61bf41a369348797f57161cfacdab2f9793e6d82dc24c40bb627b9edaeeb
-
Filesize
352B
MD594c10cd6b2e507270800006901a1463a
SHA1ec8da190a7b869b321e3a66140c42849d5b801ad
SHA256cf1cdf0a1cb0db9d7376918a6311367d6e1d42e294e0a768c8c99d39ceefdc74
SHA512a6cfe0fdeef28ebdf44d8d2b37dd93bf02d8cd28345f7529cb95a13912c1e63d1d00284b9b48f26c8b19f3540d1e3a2dda6a866a22bb150ac2eede3ed7346272
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB