Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-01-2025 13:21
General
-
Target
1dbc5f8e8ec92fb0abc1f723d91ee2a47b234ab95c57763e4abc3e39f3c3ed17N.exe
-
Size
29KB
-
MD5
a63b6c78780bc2a07627f7d23cab9b20
-
SHA1
832c92cf6e933fecbe7304565e653ff589cff167
-
SHA256
1dbc5f8e8ec92fb0abc1f723d91ee2a47b234ab95c57763e4abc3e39f3c3ed17
-
SHA512
5d3f36aeb7f71cabb1f46f1645011631552755a60591b5bb2060edeed4b6f430c0efda068fd35dbf77c680244b13d55e5a143c4e017a89ec77c55dea7b35d177
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/g:AEwVs+0jNDY1qi/qI
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dbc5f8e8ec92fb0abc1f723d91ee2a47b234ab95c57763e4abc3e39f3c3ed17N.exe"C:\Users\Admin\AppData\Local\Temp\1dbc5f8e8ec92fb0abc1f723d91ee2a47b234ab95c57763e4abc3e39f3c3ed17N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58188fde87765a2b48d4c4b68279f5284
SHA1cb94c16a74616bbe96f4fc5ed2b0889b4a27264d
SHA256b99d3d0e456cf72bb6dd7859954cd0d389f18db08eefbec331d3e9a6e817e8d6
SHA5120a56409ae2658d40fdf7ac162e0c3702edcc3b455822d070344753494e0f7fab2134e9950c6aa69523564e32184cdcab08881ceae42f0be80721c7a3f6caeac7
-
Filesize
351B
MD53ce0c4ce4cddbcfab2a68a11f499ad07
SHA1cd130adaa217e60f70af6cbf8829e8f75940a5cc
SHA256b01f8e053094538913159b3f45633e8206fc5c4671ef07cc98af5c198fe7a63c
SHA51295b8452e319349ce3b0c64169d036854a41cd4422b4fac3f870a064a8752e31a571f86b5685543322e53e40daa5f17d06359f0a90c2d2831c513256d74cce0a3
-
Filesize
320B
MD573ff85a0edb5fb35e34a4fbe9e801486
SHA14cccc5fc4d02ee3cf57f3089c3830f4dd6f4139d
SHA2564cdfcf767d0658c831a228a99dfead1341771f322531ffc4ffe2964fde6ec290
SHA5124b6ded032fc8a1d66151eaf47bb1ab8d86ca6a739042edb0d41cdade5569a2566a236da7d2c30d7216e600494dbde294668ef4b7a68991f176d034d2809e0039
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB