Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 06:02

General

  • Target

    a9bb94285f1a2cca45b71712f72abbb9b4a030a9efb7fb7e8e86d9033e77fb8d.exe

  • Size

    29KB

  • MD5

    9aa9871e981b73d63a4cebfe6ccf4452

  • SHA1

    48bb02408b47821b96adb1c16e11eca067c018d7

  • SHA256

    a9bb94285f1a2cca45b71712f72abbb9b4a030a9efb7fb7e8e86d9033e77fb8d

  • SHA512

    fe609ac6be130d420f1336e1adf85caaeae623f283dee47eb49535e76479f04c7b2d253ddb3bd7a072dd8ceda0fae94a6eb9cbf0d7d828fb527d27d9e7e4c20d

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ahz:AEwVs+0jNDY1qi/qyB

Malware Config

Signatures

  • Detects MyDoom family 5 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9bb94285f1a2cca45b71712f72abbb9b4a030a9efb7fb7e8e86d9033e77fb8d.exe
    "C:\Users\Admin\AppData\Local\Temp\a9bb94285f1a2cca45b71712f72abbb9b4a030a9efb7fb7e8e86d9033e77fb8d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB5D9.tmp

    Filesize

    29KB

    MD5

    65d3cd4e7c96b6e5f65b902b535aab3b

    SHA1

    88887ccd4fa0f1faaa93188cf237519b02920d39

    SHA256

    0d03845d1da434057f005eaaf95baf38b17aa20099e04801818649ba8be59388

    SHA512

    65f96d7d0171a3fa2406f12330b1502d981eb50ad94cfe6dadab411388fd2fd7b259e1024fcfdaa399e0bdf4d8a8a294ceb938de651190abe9b472fc42198d93

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    2d5c4e6afb958cbeac42f860e9ad6583

    SHA1

    d04b41b62eca3054255081536ddce7afca49e163

    SHA256

    96ddd83df71ac9a1b389a8424103e3236ee1ebf9ba4da635dda1664f202a5a4a

    SHA512

    e0d846d4e0a19281315abad86b64cc8f2cff3b36c8ccd7061d4fbaa9e115d6a072ad624bbcf88d35a0e02bfebeb6d4acd9a778ba464c5e31a46e0e92d97f195e

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2064-41-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-53-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-29-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-88-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-48-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-84-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2316-64-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2316-59-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2316-3-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/2316-16-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2316-83-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2316-87-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2316-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB