Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-01-2025 08:12
General
-
Target
ea351e72e75e11576fe17099a62a082af113714277109c8b8d5ff0db13692ac2.exe
-
Size
29KB
-
MD5
5be99e8af5153ead784144e9d50c9b44
-
SHA1
218768d4b7907e4f1a75d4a9419ead4b3dabee45
-
SHA256
ea351e72e75e11576fe17099a62a082af113714277109c8b8d5ff0db13692ac2
-
SHA512
2e93b80e182ffa1e73fd8950a2541659e4160c7ee5da54ef9af824c9aae14f96c141aeaae535317b4fc5e77bc22f0528f1627655a7e2176315aae4b47ca0c75a
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/W:AEwVs+0jNDY1qi/q+
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea351e72e75e11576fe17099a62a082af113714277109c8b8d5ff0db13692ac2.exe"C:\Users\Admin\AppData\Local\Temp\ea351e72e75e11576fe17099a62a082af113714277109c8b8d5ff0db13692ac2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5d6a110f3e35843539693c63ed89e8fe7
SHA167353916dd9c6b57e93e9adb69cad0a9e38a7561
SHA2562ed588a93a0d1028c97271523900497f2b69dd97df8fe4a75a1301754189ac69
SHA5124c0feaa85d4a531b4f02c553c93d68facf6cb3e82319bbbcd2351e623e83c962768aef64aa61b42d42c59a2411e6277017a7480fecb98b5799457be30290a049
-
Filesize
356B
MD5b9b484a8014bd6355dad32a74b26f40f
SHA143dbcc7fb21996d0609091100decea4d694243bb
SHA256295c23718a0e928e887e9df2237ad0c484d7600374417dc0880a523166eaaab4
SHA512358759677f0df8382911f4703d7d4eb34be877303956cf02527a4c9d22d3276251579f44d6f0720ad045c37f7358cb6157092e8aad9a31dd82299431d424bd4d
-
Filesize
320B
MD5cd3000ad5de3885778182873bdd834c9
SHA1259ddbd952aaddf1c1d85b3680daa34d5796907e
SHA256d2ecb32be41b04b430b36551aee4d1cd4c71e7c29b2225d18ef898664b898926
SHA512b3ff5c7104b48c154a4076ba14ceadbdec2e1e5f25a4c4dc101ddb03c8b613555ae3e96d9eb1223194c014264860b4a068248a05c154a8e90312687e01a0106d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB