Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07/01/2025, 01:50
General
-
Target
c3e37866427c6e4540162d5d1308f8e35ec33dde84a8d0207ac8da60183ed039.exe
-
Size
29KB
-
MD5
d7c3b7ca7ea5cb0ab6a9c5ad68c97c40
-
SHA1
1c96d5d66c13c8603639880d1fe5aaa2289f4947
-
SHA256
c3e37866427c6e4540162d5d1308f8e35ec33dde84a8d0207ac8da60183ed039
-
SHA512
58acc9c8248c1f1fa9516abdbd5d85b907a36b5fd85da58bbd21795211da5db7c390ef7d45fe4acced6b3cd293e2e0f214a01c8c3e2308a52567cd08b269dbce
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/rhx:AEwVs+0jNDY1qi/qjL
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3e37866427c6e4540162d5d1308f8e35ec33dde84a8d0207ac8da60183ed039.exe"C:\Users\Admin\AppData\Local\Temp\c3e37866427c6e4540162d5d1308f8e35ec33dde84a8d0207ac8da60183ed039.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD514da6ee5ea79e0e5065ffa3e93bc7004
SHA1a7c78e0373430ca3243b0e28811a064e14a07b78
SHA256492d7e623d80f1cf420626de595db4f5a208440206e8f2013351c6e0aafae1ed
SHA5123c7f7e6d4ba734684a14f9fc9d17d145d72235a8c98ff3303adde686a6ead57faf8edd04aae0a22068290660e838b3328fefe9285cfa58d7ab673f47e48f7a30
-
Filesize
320B
MD5c10034146561d094da464aefd0f6d819
SHA161bd0f9f388176c6a7bebf6037469356ab5c3097
SHA256f0400cccbae225cb4f4f9d712e6ac5ed909b604edf6c8dfb87b318abaee8cc21
SHA5121f3b9f43083a4141cdb0ab3d1f8afe981f85bae0f8e33088a1a3f19fe5e201c397d654fb5925083a008ac4f8f31773e74cedd5e9ee860523a15c66e30a064cf0
-
Filesize
320B
MD5e0f224bb1e60ae06a5e5ca4b79256243
SHA127a90a1168142f32c98d144a759d155539cff05f
SHA256f2d7609ab12a89161c1fcdc8469fef1731932f15e46857c1aeefa406a0c533ff
SHA512043c79dc5d7e04b5df24a03ffb8e110c921d11b4edc133f5da8b9a1e3953f05938ba2f585f287765ad9e3ad6ee67452b29163ccdbf2111801f4c8353ce6afd09
-
Filesize
320B
MD53f200a500a259b20d58cedecd79bd346
SHA11f401f95804031a0a9a672b20e3a7924e8917b2d
SHA25652ed06488868f04c3665286ed3584a982295a2b735daa8c5a3f7657b97ee90ac
SHA5122ba533436dc44195198663b02254b3b03acc753da627509190414e53456f6a6a90bcec0411a7802da82b98572d8ef596141a739976a255a1cc28e3619ab17d50
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB