Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2025 04:02
Behavioral task
behavioral1
Sample
8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe
Resource
win10v2004-20241007-en
General
-
Target
8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe
-
Size
29KB
-
MD5
3f2aa9cc9755478ac2183e503afc5a70
-
SHA1
c427b344a42b18bc057a5489c9d0431b4f5bf06e
-
SHA256
8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11
-
SHA512
60bcc130d4def43ded4808dd09a1a29abba77128cb4bcaaaa7cac581a3af22c2f12c596b008e679448a7342c3124691ed0ce1f12d3adc162b827a8cc83461945
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/lhX:AEwVs+0jNDY1qi/q91
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
resource yara_rule behavioral2/memory/2452-13-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/2452-49-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/2452-99-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/2452-138-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/2452-168-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/2452-175-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 1 IoCs
pid Process 4568 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral2/memory/2452-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x000b000000023b8e-4.dat upx behavioral2/memory/4568-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2452-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-15-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-16-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-33-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-40-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-45-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2452-49-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-50-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x0004000000000709-60.dat upx behavioral2/memory/2452-99-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-100-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2452-138-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-148-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2452-168-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-169-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4568-171-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2452-175-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4568-176-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\java.exe 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe File created C:\Windows\java.exe 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe File created C:\Windows\services.exe 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2452 wrote to memory of 4568 2452 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe 82 PID 2452 wrote to memory of 4568 2452 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe 82 PID 2452 wrote to memory of 4568 2452 8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe"C:\Users\Admin\AppData\Local\Temp\8df8b9064c8aa84b1abaf4dd69463d2ff5ef4f3acde9c145f1a1e4c2c28aed11.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5829d50afd17e0bb8652fa0ecbf4d4642
SHA1dfbf9453165eafc7cd3bdbfbc40a0f411b05cb58
SHA2568c7c1412f95494c4bf17f49d060eb4116224c6d8961fab0c1678a8893a5af80f
SHA512675e7ccbde011534ebaff586a2cefcef41790f289ae38271c82a0b6974830818308474d75180e766c79bede72b9a6770f0ff890e1c555af8c76bef52077b9582
-
Filesize
320B
MD573e8dbc52c87d843e201bf9a2a732182
SHA1ba637531d63c636dda5b64c5348cd8dce7b4335a
SHA25639632defe11857ead0485bfd4a4a351d59e89d709f8f374a483da2ccc6273c24
SHA51208d2a776c52a0e6f125a75c91bbc5363bfb7d4f162dec725a9e7519d1f8311075be809959b8224804c2807164c7075dec3f4b5109741fc5a1bb046286c04bf78
-
Filesize
320B
MD5705a13b9e6db0c1146bf7aca56932417
SHA1f12428789dc665cd4d854f2bbd5de45b90b1d443
SHA256ab56c885fe5dfde563ff5ad7a763f678fab56f6cb7de4568180f96ec1ca6337f
SHA5124214cc4e9e77c5ef43c4004a5d69779ec1f517e91ea8612eb4c32d0cc75a70af0a7440de213ac789cd09ff0600c7df956c65c53ec491f4c2b21bfa9e7066a649
-
Filesize
320B
MD55381ca35139e182119c5894c04906be0
SHA15a77052539614b7c73f3920d96414ea6f3943022
SHA256cad7d226d96035539d5d02c0387c9a001bf0855749e17b6784acee4dff473dd7
SHA51283205bee8785472a804515ade8794957fab6586c8e262adae428ebe027fc397bcb265d50ceadcb1a8a9e0906bf3a759dc25a01574ddb75c79ea641ad6773f597
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2