Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-01-2025 03:22
General
-
Target
f9e0b955a8ba07827edb48966cbc936c97b341b156f496fc6789104f58bf3b4cN.exe
-
Size
29KB
-
MD5
c1112c0583d92c0af52cced4c23073d0
-
SHA1
0904cc407bb4665cb6977fed84405f50a9cf876d
-
SHA256
f9e0b955a8ba07827edb48966cbc936c97b341b156f496fc6789104f58bf3b4c
-
SHA512
d7fea94aea779e60e25c0d6702a62954a08f406c66ef032cac4af23a1220c0e9dabfa95fdc6a0493d1f164b9f4d777d2e2090af590a01dd4669b3db930449e4d
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/H2K:AEwVs+0jNDY1qi/q/R
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9e0b955a8ba07827edb48966cbc936c97b341b156f496fc6789104f58bf3b4cN.exe"C:\Users\Admin\AppData\Local\Temp\f9e0b955a8ba07827edb48966cbc936c97b341b156f496fc6789104f58bf3b4cN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD59845b42410a588a623edae0d5937aab8
SHA188d2d488580bc87e0d9db08123c752ab771c1f8a
SHA256301eed5d2dd52405191f411e095c2665a0a8f2260f6cc71bb918f4e4dee9fd03
SHA512e38ffee44e33c9493098334cdeb948414bbdef18bbdad267de825f6c4541b6c55c026ab46dc4443ad480586d004d6329f0602afdc1301c6afd9b8fa8a656f5ee
-
Filesize
29KB
MD56189672fa9321ef1bbd4309b2344468a
SHA1e214f94497d73371a27a59fb57c00b5c3a4f7f71
SHA256b1b373e50c3eb94483814bb3fae6ee9b52c38a90d166fd4d7ddcab26e8ee6ea8
SHA512ef8f0b00a35ca97e8196366567a3f0dc2285d3c37f5cb501f916c5d7f765e8240d72e3d31fa47b0254d8c9aff40fd8c0fd73e759f547e9a4c6283fb537cacde8
-
Filesize
352B
MD595c39821efa83d504596f68a9bb6fff1
SHA18849306cbdb28b8dafd42cbd749e65a115b78652
SHA2561e1ae34290cfe528680f21060cf9b8b903cadabe241098c7d820cc0f066ad47e
SHA5122b5869f7c82891a57f5144388ebb356671c65ebb7bfcd6bd0b39454f0f9b4bb6fd23c02dc1ba13714db2e64663915cefe8481b39796e62d974383ea0006a1882
-
Filesize
352B
MD54f3f698c2c95e9fc8f9f221f6755af35
SHA16d8f12f7b1ad2acdf2ed8e941b7c0af6e5febd30
SHA25610ef6aa05b3ca73ed786aed97628f6f67780c456281f33d82c6d85fb69ca54d1
SHA5125acbf04f465a5a7547d72228f0b947b396e296a94e04e9bd7c8a066a105f2c6dc9424314ae0f2184348eb67e8a9065575be36545bc6df63afad379d6a7975400
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB