Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 01:52
General
-
Target
15b71800cff82c4f95cf1167dc9febfe89f33bd6abb217e37dc63f3d91f64d37.exe
-
Size
29KB
-
MD5
18f1ff4a7e13644f8e703847a3b1d06b
-
SHA1
f98883fab256215efd37d3aba01b33dca6ac8790
-
SHA256
15b71800cff82c4f95cf1167dc9febfe89f33bd6abb217e37dc63f3d91f64d37
-
SHA512
ba60cfbf1f67c5443fc235dd9b0e479a3e62c645e23acbc9e7d8e13e221f08b34ce08bc8c3a28c1b60774b303c0263a3843a333f56af5deb29efa945d1b273d2
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ch5:AEwVs+0jNDY1qi/q6j
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b71800cff82c4f95cf1167dc9febfe89f33bd6abb217e37dc63f3d91f64d37.exe"C:\Users\Admin\AppData\Local\Temp\15b71800cff82c4f95cf1167dc9febfe89f33bd6abb217e37dc63f3d91f64d37.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5c6338f6aa8646d06c126a0bacf088be1
SHA181afb2795c53c7a6803fbe4720f8c67d34284b06
SHA256c801a41f3e9c2e719ef6c00d2ddf080f37ad9b37afce03fa1531a88dca6a471a
SHA51215928c24cde15c2b8a71e3dabebdf3a065e8c002101012c5385d0f8928bf42cfe7dd3e9f34a7685cad503451e51d8b022ab643f6b869782109abb22909685f4d
-
Filesize
320B
MD51659844772a5ec48245d5565b480fd93
SHA1dbf3ac07b82d7a75e4732dc0a282ee2b1aaae270
SHA2564aabfa2a2aad3a4749bb8ae1fc245dce224fe47a456e848c5b144456fe4715c8
SHA5127080a70695624516172f40d1745db79c17732de9d8aef2a12d994a5055e21b9f8a48550fd76c786614400c50c8f873b5136dd30490348c5a3abf0d5b039e4f64
-
Filesize
320B
MD5ec7b823d959c9ab59bed7a38dd1f9d4d
SHA1984e122bd1cab1a8f76268a2be178712dc85d8f7
SHA256fb25b46febd80a036456bd99e58c36df7294fd1205e082f47b297d1de9db1d03
SHA5122803a4b685d411df3a7237d9dd9bd0a5b8a40dad9ed7c9c958c103569546d70e20a01ac115344edbfd699ed72136040c023b4e72af9d28b15f08323269f7b8d3
-
Filesize
320B
MD59cafd4b155a151e9e4ac93373c8da56a
SHA1ca725982077e1a53ddb750aeef3558aa4360176b
SHA256f5d245fc1a6b059b867e4b6f15cb82cd2ec432e959b51d9a88861f2947269967
SHA5127ac830d1fd1017ccaa9662448690d781c32b9c46bc598dce324806dcd7a2147f8e6b6a1dcd76e0c371e1e4dcdfddfb8c69904d096dec2e2c70a22e86afbd38e8
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB