Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 17:04
General
-
Target
59b13ba5b09fe5091c9c9f5eff7e9d77a286ad6c7c37f6ae113fefc1c8fb29a5N.exe
-
Size
28KB
-
MD5
7b175153a1aee5a54db0768ea12a3050
-
SHA1
05cc3910f884107da427dc899411d7b828c0b1b4
-
SHA256
59b13ba5b09fe5091c9c9f5eff7e9d77a286ad6c7c37f6ae113fefc1c8fb29a5
-
SHA512
7b074c2b96705281a53eb8527b2f0e7c0ccb355650b2d9916330c9b9a5ec3d5dc9f2da50cfe4f6b3b9c11f26460d4d62285e198c2655648d73bdc4e8a9a8636a
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNss0WP:Dv8IRRdsxq1DjJcqflWP
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b13ba5b09fe5091c9c9f5eff7e9d77a286ad6c7c37f6ae113fefc1c8fb29a5N.exe"C:\Users\Admin\AppData\Local\Temp\59b13ba5b09fe5091c9c9f5eff7e9d77a286ad6c7c37f6ae113fefc1c8fb29a5N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD58d718d3df5fc3e95f19a709840b7b7c6
SHA147cb0fb242dc5e1f9d55315d8ff9cc43252c2985
SHA2560b52130ad7cb8a6b01745ae1107168d994551d85a49ca801ff22e2ce999b0382
SHA512019e75f1092cdc8b360480b74f281c45d511eaf300acadd8f8ef49fb779d1ca9bd95d678eac1299bc17f5aa6df4002ba668da74455ea29a3bb2a3762eb3afb2e
-
Filesize
28KB
MD59e32ad827e3a7e900dbdb4d86a258243
SHA124275a89a801bbff7bd79937f9390bfe89a0b9b4
SHA256a1d6964af0dae2480f99ad3fa3d13d16b7a9268fe30ac48ca2837f318b8c2887
SHA5122c88da80901ce001672f540e8903bc4d8be45c9dbcea33a40757d6d402740f4c1986ea85e793cb21502d1716efef95726d43c7046beaa61b6f27cae2f7723a8b
-
Filesize
1KB
MD55325fbe6617f7f9fa4d0b2c89022671e
SHA1ff38fba53bd13accb76941ded390520738781305
SHA2568eb30f8980fb560bec1250afca7e02b72be556d5d8b5d8262380bc6118fb1e17
SHA512c8a70f7e0f5eaa27c6dac2fa1771463831ef4800ff3d2919cf11a340efe94e80cbeb1a3c52154c03eee202e62f6aabc93e59082ef2bdd753ea208e6dfcaaf603
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB