Analysis
-
max time kernel
100s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 15:20
General
-
Target
66e429ede3629741daf06dccbf1e964db8a45b03efa542fd22980741deb08ebfN.exe
-
Size
28KB
-
MD5
773ad7b3f4d53fee6c4a610d54d25640
-
SHA1
5ca91baa6378f0008ba24c5770f5d2d692fef6b8
-
SHA256
66e429ede3629741daf06dccbf1e964db8a45b03efa542fd22980741deb08ebf
-
SHA512
db1866ecb7747418600584576e4e99a6751a3831031daf68f75c97e4299a5b64dec301f4c4d8a43a0828bef7a658e97dfc0e6b44ce25bfdaf27371f8fddf92ac
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN+L4tcyP:Dv8IRRdsxq1DjJcqfeFP
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66e429ede3629741daf06dccbf1e964db8a45b03efa542fd22980741deb08ebfN.exe"C:\Users\Admin\AppData\Local\Temp\66e429ede3629741daf06dccbf1e964db8a45b03efa542fd22980741deb08ebfN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
1KB
MD59b1523d5b293c6bb2ce3dc532b8182d7
SHA1bee2fa0cb0b581eb9ee5ef7a8c1695e3f0fb8a2b
SHA2568c7781a966f0ce3a7cf8981791fad66d7441ca3ce7a6612b91ad122cbb845beb
SHA51273a85d2e52c1294d53c7c2332d933e66434cca4217621111acd80045911b25240554900db9a47f8c3c01148b33b62c9ab849e068aae7ae1f5002c3f0120f075c
-
Filesize
28KB
MD5970305a6c568c9cb9c37bc65ece2e230
SHA1159c3c74c24949aaf46cb95ad51f52f17c62381f
SHA25619e7368d02c2c4e637890f4c1dea959548db529449b3e992d1ebd08191dbf295
SHA5125d279b7956285eeaaaab63dbe1297262ca028f9c2eb23d7047a405d66697e231f034bf4341a2f6fc950ceebf1e9c10958dc3f50d49ffd4713a1248d9f72eccdf
-
Filesize
1KB
MD52abbbceea052bac12235014f9960a3ce
SHA10505831fa8f1d100807a9e3856b51184676ccbe5
SHA2563bbb54d428cf3df7dc7c111b0e1d16381c73a3ca0a482cf569a53c6fec88d809
SHA512349169eeb5d58bd182abc19d9e2a6a06f72a787e25c472dc1fba8fd9d4123a20eb075ebf32010ea86f4131770ccf6a668bd94636e65bf24441dd2c9690873e33
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB