Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 08:59
General
-
Target
6d0b2f3602805b9bed5470b5cc676c4c09cc7b312caf52469758fbaa7d6738c4.exe
-
Size
29KB
-
MD5
afc3b1273e3826a5c3363ff619176203
-
SHA1
3cf697a7192c4b7eb563b8441bdeafb1e94542c8
-
SHA256
6d0b2f3602805b9bed5470b5cc676c4c09cc7b312caf52469758fbaa7d6738c4
-
SHA512
02e500c25fb0864e06dd46935ced0399f835a2749821e7f234ce9d06ca996c52ccb4decc0efdb7d6e55d2dd261a8213a82cc4a29deef58d902ece012d2401108
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ey:AEwVs+0jNDY1qi/qZ
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d0b2f3602805b9bed5470b5cc676c4c09cc7b312caf52469758fbaa7d6738c4.exe"C:\Users\Admin\AppData\Local\Temp\6d0b2f3602805b9bed5470b5cc676c4c09cc7b312caf52469758fbaa7d6738c4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD536d2651bc93bec846fcdc426015c8130
SHA196e614fb0b7314f203b51c14326de0e5035a3540
SHA2566cdab473e84d76a6e54ae86b307c45d6e3f13b68650bd6deb1df8e349825fbf2
SHA512f5c6120cca82a34513632f4fd4c48dc7b0712ae04bf837c971eb692331f73bb61fe81da36aa3919f20a2aeec8a258d2b592bc8aa9269d0fc71d2358fb40d396c
-
Filesize
384B
MD584448f4a9ca2a08a669228f7c038363f
SHA11b30b4a96c9c88fe7b4f60fad389567116b28cc3
SHA256dd9e952e633f652c921124eb21853acc9f945237d99076ca8f27074fdf7b8dd6
SHA5129886826c120c2b5dd0ef58ae3d800c97fe3fe6a747fa27122ab28ef49a27935a5128d7a991f44f80fe292c5b3fd276780d49ebe8e980b02826537c6dbfb752c9
-
Filesize
384B
MD54482b76fe7db2e82c2817b64db262967
SHA187bebb75f1e9b9543a64665eb20eec74f56488fa
SHA256b366e9482d0b6c26ff61083fdd60296df42a2cae07016a6eba9a75f488c6d7a7
SHA512e630ed799b65415115e04510c2e23beaa84c778ef252c3de4b6013f00717663bd5cff5e5ee0c4cc5ea8c664394e2fd8326fe008b9aaa7a8dc31e072350f927e4
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB