Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
10-01-2025 04:16
General
-
Target
8ea0ec73831b636a4e308a0f001a6c8fe8089039a6092461fec9b68359b313a8.exe
-
Size
29KB
-
MD5
78bb7ede9965c2c355058b43dd659df6
-
SHA1
f2db91a94de7bb081552fe6e21190b81c0e9b356
-
SHA256
8ea0ec73831b636a4e308a0f001a6c8fe8089039a6092461fec9b68359b313a8
-
SHA512
48b8821d309995438a6c44c9e0882f2edf98578cf5b63bce90765b3c1f02c68a910e7d3b887ab101bd2a61e7c05bc2c8f2a8aa0f5b8c7387c539386f3e4366ce
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/0hQ:AEwVs+0jNDY1qi/q8m
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ea0ec73831b636a4e308a0f001a6c8fe8089039a6092461fec9b68359b313a8.exe"C:\Users\Admin\AppData\Local\Temp\8ea0ec73831b636a4e308a0f001a6c8fe8089039a6092461fec9b68359b313a8.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5ec3871feea40adf11e5ecee10b000e61
SHA1a239bddd3599be6d65cadc258b73c33e17edc49f
SHA25685a52b034e95941803db9cfc7122c90d99c5e91dc0d305f9c2937a29082312b8
SHA512f2c414299f07c310ed8cf0d708f9750bc0a7e82d63dba39027bbb7109e50f3119e010cd0073933a5a009f8745ff7d5f59a102b75ead00dfaf4958749ea056c29
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
29KB
MD5b87fe0420f65f619e5c427e0cc34526a
SHA17b140957a63b4c876f1f684e6bad2ff012ee3de2
SHA2566ac5f80a106b18203ee6b51e664958a0602fe41fce658026233503352b92074f
SHA512ba9c974f351d08a132459e9266332e73e2bc3943f8bbc6c2877884a88f2d3efa25ff5e0b437a27b9c6c826a52bbce14231a95551f538a51f1118ec4d2cfa6f4f
-
Filesize
320B
MD5b8456359616f2e8743152ea082cf9e15
SHA12e5c2d6372c8b3e98190c826c1811142aae2253c
SHA2565be8874ece8fcf76e96fcd7c51ccc6dba32adf7fc8732b9f4ca847e9e8067aa2
SHA512f6790fb6e496989f289a412b2b806dfb002a347bd4d1006cf7cc7e57e898b8209ef4ea7a022a2f5894e5b9233b2926d9653234cc0a312111421cb367d8db5987
-
Filesize
320B
MD5ffed17470f724fd6bc6d1b19413bb33e
SHA1e87a69f099f9bd45e370811636d9881f479c5f2e
SHA256c29f4306023b8f1d32440bc94f8df977a9120c4e81539c9becc981f630f5cee1
SHA51252f3c3a3063fdc1d4ab0d9ea05ed01837fc055d052aa7d44f437685a81cee98ca04c9b111e6f324ac1c02fc226ec0fa41118ece6a83954dcaee35fcf1741c771
-
Filesize
320B
MD54080be90eb2342aada94d1465195ac47
SHA1e6aa84ba95bc5b0ae4a8cd85a807aca125b988bf
SHA25662b1a4612fe6ac57111705435af8e4adba5a918855130700709feebffd37de52
SHA51237a4789a9f4d3ffe8f38a197fb075e967324be137b3218ca3470bf86bc584bcc7c5285302556f91f97e80a9eb08aea38932bca6cdfeda8d38ae1316d273bae79
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB