Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-01-2025 02:18
General
-
Target
a41d3018cebb5da6cb027a795121975783d65858a4e32ba4a433d2031f8651db.exe
-
Size
29KB
-
MD5
09c75e69310fee290b19378f8a402b8e
-
SHA1
11693d663fb3c66cebfb1ffaa223eb8cd2780573
-
SHA256
a41d3018cebb5da6cb027a795121975783d65858a4e32ba4a433d2031f8651db
-
SHA512
06461b68ae6836fe0bdd34a1fb4f1c26ed4e54e09ebfb8679067c5963498602b72ab2224fa6c293952ab1a2dbab23aede529ce7106a0a82623bd6f3ee5f474f2
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/q:AEwVs+0jNDY1qi/qy
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a41d3018cebb5da6cb027a795121975783d65858a4e32ba4a433d2031f8651db.exe"C:\Users\Admin\AppData\Local\Temp\a41d3018cebb5da6cb027a795121975783d65858a4e32ba4a433d2031f8651db.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD51cd2fb39e205f448831013483a343d91
SHA158d1045ebd32fb32f24875ca83e255ac6d7939f4
SHA256b17634fb5414db6a1c51b1ec183022f90a0423fe66aab4a8f900f738933ba7a2
SHA5121b8b7603953e52eb1e35c5dc4ebad4a8eb963ab84fdfa08abe5da19777d7955ab7ca45928cc70e151eec5aa568261b8a5060e2535bc4d9a640be5f611a93f3a2
-
Filesize
352B
MD57fee12b08eded5fb67a6f4fce7087c43
SHA1273d869165b91a7300d17066daad28e762324c6b
SHA2568607c45f3bfdf23880812c635f74de669d32c9e0a63439cb3205128af7cd2c69
SHA51284c62b4e346832c0daede7b278f220c518b20a80e302cde51947670b1d7f6c64afffdb8f3a8a0fcc950d35eb07269dec684701fbf8a174abc4c4521c35e02e82
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB