Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 13:08
General
-
Target
5644e1bd21aa04647ce37ff40d3a4ff11bf014494f2cdca12e002d64abe22f9fN.exe
-
Size
29KB
-
MD5
c5c5dbd5f6fc971a570aff8ed74d3f00
-
SHA1
395102aa3e4ca2eb68766a52976054ed0da0f4cd
-
SHA256
5644e1bd21aa04647ce37ff40d3a4ff11bf014494f2cdca12e002d64abe22f9f
-
SHA512
95e1dc69f057ec4d00248d6c080de7375cd9c6dd658001a45f2fdc6847ff5c21fc3ff533e6a4f263dc9f424c575fcd92f99ee25852582411eb464470ee9e2dfb
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/F2:AEwVs+0jNDY1qi/qU
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5644e1bd21aa04647ce37ff40d3a4ff11bf014494f2cdca12e002d64abe22f9fN.exe"C:\Users\Admin\AppData\Local\Temp\5644e1bd21aa04647ce37ff40d3a4ff11bf014494f2cdca12e002d64abe22f9fN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD53ad32c1adfa5a37e79c3ef5714071230
SHA151d0206e5c49cfab14c17f0ccee34e2356711dc4
SHA256ced8fded557fbf37c3f9bd3022273ee3ea5b84065541d7ed38fe44cf01a50aa3
SHA512a8fd147f1b8b9eea59341ba5f7e266568eaeb3888e48b0047e62f5ce5876c9393b19619759536bc45a2368832956a94f89b8e153e754b76351442340065096a8
-
Filesize
352B
MD50f4437299dab896e0443995075f55cd0
SHA12db23674fb1f9ae6e0c62aa639c66fb921845f0e
SHA2560f9fb3f25039554bc65ef66b65dfc09d858281f4b83262540fd637f75659fe24
SHA5129ed8056379f352379627df5015dd2ddfad34739fb19e2188c4ff699be1e353945d4d73109743b97543639137e1651d49e427f18dbfdfd3615d3a2159e134ad76
-
Filesize
352B
MD5b44d614eafca4a62973154c5a0178d2c
SHA1b3f644f1939c593b824c96a6e64848b3fe368d13
SHA256a94f383a2d14a9e6463ed38c297bd94fe6eea41beb020333d02fbd4b421152ef
SHA51299f846def00664cac7c28b1406638050e69b54b12ce29c715c3b92e2e8a12c6a9b08831387731f2402942d61c7d6523f5e93a9dd432c2bb18f4b3620e4e05967
-
Filesize
352B
MD51059b4038010c7a09b83bf576ad84e96
SHA12bdbfe5f7c227b0c1321fc6bd524b537ba996a85
SHA2561d784bb26aa201ac596000dde1d3325d87b992f53c8eef28f229bb79712417e8
SHA5121d715865bea2da5284fc785bd51f6943d71f26a63767ecff66a714a1e8f9ee613fe32c7e20daebc41cc9c52f2a655c1bf6c21b5db2fbd542e37a50e0ad86cbf6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB