Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 07:00
General
-
Target
c8278365c5e4f5a7b47f25acfa2beff3b50a55fed7d3e6068561cc7cf203dd9c.exe
-
Size
29KB
-
MD5
57f3adb99f6cc8b7ed96883cd85816b2
-
SHA1
a3700ba3c0df5abe994b2c4e983178a0714e9b43
-
SHA256
c8278365c5e4f5a7b47f25acfa2beff3b50a55fed7d3e6068561cc7cf203dd9c
-
SHA512
812807aa6488bd3922e557ef19ed99a5d42da074fc47272460b6868022238acecae3f9097414030331106d2988fcbea984dfd31d7c53f70ce3315ca80cd4802c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Im:AEwVs+0jNDY1qi/qf
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8278365c5e4f5a7b47f25acfa2beff3b50a55fed7d3e6068561cc7cf203dd9c.exe"C:\Users\Admin\AppData\Local\Temp\c8278365c5e4f5a7b47f25acfa2beff3b50a55fed7d3e6068561cc7cf203dd9c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5266f8c800dfcf2bf1b30a2676c8281a2
SHA1e3e7d4bec27c4f8387c03ad0c8cbbf4668c4f2b4
SHA256d23d5234fdedd5e66682177d91251590c6c0644a3ef0fbc93d63ab7d921d4420
SHA5124d319f9268199fd3ffc4cd5b966c274272342810f58016b0378ebda47ff92430e0dda684927d4d30e5e2db1f9f98f6ed24f84aa0e2e30ca9ebe17c16eed39d87
-
Filesize
29KB
MD581b3640823dab4ffd1a5bb7d503221ab
SHA1b549aa26a5612658331e6f2b1801f2c49382c5a4
SHA256601d1a24508c19e21062311e1f6d34447324eb0879a737f73b78e86b268f82f8
SHA512c3ae66c13606dae6de5169001f2c7e33a55826df6e091284ff0fca2d3a49baf8789af2e4a7c4a90f95a387e3b8226a63b982d0bf0595c8562446246f7ff22f4c
-
Filesize
384B
MD5d18e65875d06200ea37db932626fa0fc
SHA19c1064e6ed3dc06aeb2729a4c703242673185e18
SHA256e5729a495f595acd059d85dc8dc0587b699e08231c697de941f7c08db8988204
SHA5126ef5a25df457797cf0bbea82a2d5e12b3429d0a7eb60af6847bed00a7468e2fbaff0ca14ec1a63a80c4a8d42077c5c262bde2e608ffd22db3e27ca668a1a6b76
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB