Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-01-2025 04:02

General

  • Target

    8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe

  • Size

    29KB

  • MD5

    3f2aa9cc9755478ac2183e503afc5a70

  • SHA1

    c427b344a42b18bc057a5489c9d0431b4f5bf06e

  • SHA256

    8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11

  • SHA512

    60bcc130d4def43ded4808dd09a1a29abba77128cb4bcaaaa7cac581a3af22c2f12c596b008e679448a7342c3124691ed0ce1f12d3adc162b827a8cc83461945

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/lhX:AEwVs+0jNDY1qi/q91

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe
    "C:\Users\Admin\AppData\Local\Temp\8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IQ93NPJ1\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\tmpFE43.tmp

    Filesize

    29KB

    MD5

    829d50afd17e0bb8652fa0ecbf4d4642

    SHA1

    dfbf9453165eafc7cd3bdbfbc40a0f411b05cb58

    SHA256

    8c7c1412f95494c4bf17f49d060eb4116224c6d8961fab0c1678a8893a5af80f

    SHA512

    675e7ccbde011534ebaff586a2cefcef41790f289ae38271c82a0b6974830818308474d75180e766c79bede72b9a6770f0ff890e1c555af8c76bef52077b9582

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    73e8dbc52c87d843e201bf9a2a732182

    SHA1

    ba637531d63c636dda5b64c5348cd8dce7b4335a

    SHA256

    39632defe11857ead0485bfd4a4a351d59e89d709f8f374a483da2ccc6273c24

    SHA512

    08d2a776c52a0e6f125a75c91bbc5363bfb7d4f162dec725a9e7519d1f8311075be809959b8224804c2807164c7075dec3f4b5109741fc5a1bb046286c04bf78

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    705a13b9e6db0c1146bf7aca56932417

    SHA1

    f12428789dc665cd4d854f2bbd5de45b90b1d443

    SHA256

    ab56c885fe5dfde563ff5ad7a763f678fab56f6cb7de4568180f96ec1ca6337f

    SHA512

    4214cc4e9e77c5ef43c4004a5d69779ec1f517e91ea8612eb4c32d0cc75a70af0a7440de213ac789cd09ff0600c7df956c65c53ec491f4c2b21bfa9e7066a649

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    5381ca35139e182119c5894c04906be0

    SHA1

    5a77052539614b7c73f3920d96414ea6f3943022

    SHA256

    cad7d226d96035539d5d02c0387c9a001bf0855749e17b6784acee4dff473dd7

    SHA512

    83205bee8785472a804515ade8794957fab6586c8e262adae428ebe027fc397bcb265d50ceadcb1a8a9e0906bf3a759dc25a01574ddb75c79ea641ad6773f597

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2452-138-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-49-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-175-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-168-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2452-99-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4568-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-100-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-148-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-169-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-171-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-176-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4568-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB