Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-01-2025 04:59
General
-
Target
a72c3853eead4f1986351dab39ff0d8274c3772ac50bebc4481428df1848a072.exe
-
Size
29KB
-
MD5
0a81f5d3c7cc3cdef7300d324604b8c9
-
SHA1
2ef7dd12c5d081cb597530ef7b895de927401324
-
SHA256
a72c3853eead4f1986351dab39ff0d8274c3772ac50bebc4481428df1848a072
-
SHA512
8d2d0e9a2b12adcce2e81ecce8eb0c3aef13047f8b945746dce5af96f1f5a4338a3043318db6f16097d15fc46039acce4eef1a1ae57061fc8dcf89af829e9bd0
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/6hQ:AEwVs+0jNDY1qi/qCm
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a72c3853eead4f1986351dab39ff0d8274c3772ac50bebc4481428df1848a072.exe"C:\Users\Admin\AppData\Local\Temp\a72c3853eead4f1986351dab39ff0d8274c3772ac50bebc4481428df1848a072.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD56d660ec0b12f084dabce22feb2c67f36
SHA1d12c667ec0a68e7afce1604040dc1915f5aac1d1
SHA2563535b3767791f2ddeaa45ea43165c75cd6232e33f71b6b153c7dd742095ba7a4
SHA5122af90d774a976f9cc7417a632af1eb1d4df8ef80af4f5333b6b37236755cc7d5f35d3b59919002390f8ea43713cc0a4c35f6c715f1d2d53f1cf27b383e917274
-
Filesize
29KB
MD57a6384d76187227f13996622c7c84570
SHA1ab0fab0dcaeb64a9f2a581cf42013f763e5fcac3
SHA2565df3b6fa1ede73c76334c5223d51a9e529c9d240ce6b1213b97824747a8ee9fe
SHA51237763934f61b482f757b2e3d88e8e08b046c4c701d16f3c32ee042fd64cf621b6116b19aaa0b868ef684d91bff8c0d5add9aa94a28b8ff5b9cbbbb8915c956d4
-
Filesize
320B
MD5668ff77c16124b2fdaff28867abf1fcc
SHA198f2dc2dfd54a54a8ee992141177ae82c38e0429
SHA2564497f0a03d0921027ae1dc1bf72464200e0d39b0bd92037371310ad0b03d7fb6
SHA512a1cfe3ee3611478dff9a2ee8e8760a5dbf5d46dd27beb54bc37443ca9d850f09cf5c8ec7443a826ff76f4f78a782815504f1a5ebc1d62c32f0928e3a407408bd
-
Filesize
320B
MD5e125b560e2c6eba2507f1edc61fbb0d3
SHA18bb0ceafc35ac25cc5909796f896abdcfd6c22f0
SHA256951b299b169ff8b45dfcc8e57040044fc79582d4f7715b684f0c60cfd3d28480
SHA512770f93bcdea802bec9c02045ec788360635cd4b5d3a3544df345444168cfaa6889dcde1aceb566fc6c2e5d861d612008a18243489ae843e7b798e72f32c26a32
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB