Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 03:14
General
-
Target
fe2b598f81d392eab2cf17d68731fac2d09fa4fb242861666b8d2ffdd700bb3c.exe
-
Size
29KB
-
MD5
7f84f198a20587eb5c86638471503781
-
SHA1
96a0f26046ffafc801ea546afa5871f1ef526106
-
SHA256
fe2b598f81d392eab2cf17d68731fac2d09fa4fb242861666b8d2ffdd700bb3c
-
SHA512
0f8c2286f4a7f3b7874494c34cdf68ec0cd1f1fe3e3e05ec26a1982f647a1a9a8b69711794c54d21bb1e71e9a444b04acedaeddefebf0d0aa4d63e978fcae47e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Thhw:AEwVs+0jNDY1qi/qFW
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe2b598f81d392eab2cf17d68731fac2d09fa4fb242861666b8d2ffdd700bb3c.exe"C:\Users\Admin\AppData\Local\Temp\fe2b598f81d392eab2cf17d68731fac2d09fa4fb242861666b8d2ffdd700bb3c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD52f8a1e1b96b85cb5fdf77281d2a57f57
SHA17f8be16da933fef3a6dca4158f205a307fd6efee
SHA256e0cbff6844d49fac9efde64183f4552bf00776831196da50ed72718af29bda50
SHA512eb76086ab0ae09427ca84a4c8fd2215092d795518a601de8bebca30295f2f67932563e9ca9ce91fd99cbe1194ec3a4c614c668e627b594a018398b4f9f0dfa98
-
Filesize
320B
MD5e5aeb959bba1a186f20dcef20294f91d
SHA1aba46cb57947fdef859f1d2e7efbd8a3b4d8403d
SHA25637964d361663e2ed3a06fed726fb4c05e6006a3fe031785d52ea55c3abbfbf04
SHA512f9b98c213c86deb72dccdc5e1dbad641d90ca28bb728d465ed1db7dbf942ca135e49ef75accca050b3bbb60d7ef7bea57ae910e251e66d68b2d9215ee6fbf5dd
-
Filesize
320B
MD5cbe586d9c92865d14a825217a0af7b28
SHA1a10218e0c573d6f56552d0c6b8ad2f45561812f3
SHA256361951a7e02a78005380f433b2d0be275157ae64cec9025a9da1bb37d9fdc506
SHA512c2527d7377645d995105f5e8f7bb5322d3d35121def1c2cc54e43477de2ffd1c8d7fbbb3160319df2bf316992e6dd2575ee7078cce70955bb9c7afb4a1b82e05
-
Filesize
320B
MD5f113f549fe3ae2bf201737b1a0d4aca8
SHA1d99a9f3815b88c910a884ee3d8a98bf1dbf7eec5
SHA2563cabcfa0a765bfb5338c9961e80fde3bf511471f40fd747031c96a384fb0b86f
SHA5128d8fac00a2489ede8166edaae331923778bfd0d7ed3eff45391ff3ae21e9b238e15e073afb2c5a021d7c14561e9fef69845debc8e764e4e6273c73551f1aa90f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB