Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 01:03
General
-
Target
9038f1f61a7a8180afd9acd02348e339abced5564c0c389208083b202f0473fd.exe
-
Size
29KB
-
MD5
a5f9b61e99f35173bf640096572f16a9
-
SHA1
df8f6d7e18a61b3a01294efdd7f169557a6a951d
-
SHA256
9038f1f61a7a8180afd9acd02348e339abced5564c0c389208083b202f0473fd
-
SHA512
10cc6f3ef2ebac6e4ac2e4a95fe269beaff6713f0a0501f9826d779b8e5b1ff951a4cb58c998194a5ae5b2e11d70c4fb53f30d2011676b09e485b2abc5097343
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/fA:AEwVs+0jNDY1qi/qQ
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9038f1f61a7a8180afd9acd02348e339abced5564c0c389208083b202f0473fd.exe"C:\Users\Admin\AppData\Local\Temp\9038f1f61a7a8180afd9acd02348e339abced5564c0c389208083b202f0473fd.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD54b1eb1f6dd46ee5dea50f10ac2d798f8
SHA1daec963d801c57ab8551a4e3fbdfa4fa5e3c3509
SHA2560bcffa3188d847f28ae76e5cde3f938cf82ab739cc51620c807fce04cf55e601
SHA512e6b433ca7f40b6640023f7c847c4577b439759bc4836d7c473a41cc6442b3d29ea2a1b27aa15a9f63498e458127d16bc76795f3ae41385aad00117f4c64dfe86
-
Filesize
352B
MD5aa6b207f6d1aa1355a525b37e2b58dfe
SHA1720e8f550058fb52366e24364dcf081c09034d65
SHA256717e0d9825a71a0da8b3e065b9cd66c002f5a66d7a3f166811ddfd58811866ed
SHA5122e6abae9a5bab815189eebc128d06d68facbbbcf1455febc4ffd6743c6cfbb077430ca40cd96c0206ec954d7f75111b77174c99c67188078f7b1354dca01b036
-
Filesize
352B
MD5b523d9729f5b88729948f1de83e2c5ea
SHA19cafee30004ab76dfb84373cd751adcea07b40e0
SHA256fa0905a70d6b2f1c2619a2957e9a74e70965edef2e18bcf04c53f9105c7cd207
SHA51281c457b327e57dbe630ea80395950e962d45455f6b7600ae5e993658120e89e0bfc8a4fa56618b30cc4525e939f132973b8f93d4d5bdf4d301e964da35af0a91
-
Filesize
352B
MD5b8d0c96857a915b31b5cc045e991b142
SHA165bd45b74cc7f892211920f0b024e317d2e5f2bc
SHA256f4ecfcb14edb5f58bfddc2aadfa132a226ef9d21c3cfa1fae7f46f2bd9f48d40
SHA5126e5d5c51669ca6b3bb1c8356a04bdf37f37dd3078ea918e3ca4508896c970b0558816ea2190cab72c5eebf52d2855c65251cd3fbe721093d08fa0b2c5f8267ad
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB