Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 09:43
General
-
Target
e47892654162aebfcf92e540e8dfe57878d51a65697d6abdfd9adf018afee7b0.exe
-
Size
29KB
-
MD5
e1205b71aea184899c8e98eb353065fc
-
SHA1
4a2576e0fcfc16111ee02733736e23fa92d1b21b
-
SHA256
e47892654162aebfcf92e540e8dfe57878d51a65697d6abdfd9adf018afee7b0
-
SHA512
81314ec337bfa8d04d702c6cef1b04d20c62bd36eb3c87881cc33767b460b40c0387e01b3a7be5a9918bc728b14dec724bb491930722fdcab23c7ce4f886bf2c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ih/:AEwVs+0jNDY1qi/qAN
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e47892654162aebfcf92e540e8dfe57878d51a65697d6abdfd9adf018afee7b0.exe"C:\Users\Admin\AppData\Local\Temp\e47892654162aebfcf92e540e8dfe57878d51a65697d6abdfd9adf018afee7b0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD529f10e0441cd09c55003b74c1f1901cd
SHA16b2b4700ae4a79585f0b941c7caff79b6dc5a150
SHA2567ce6502e07e6919226622573c969bafcf0ac84e4cab71c40ccb9bd218e11bac8
SHA51258d3a18a9dfdb865e77f7d34d1d0aca152f25aade5c72ca73e53dd84177bb3443d4b3aca1e50660bdf460effc2c3203c2207cd8688edee557dd235b52898226d
-
Filesize
320B
MD58e2fb1ffae9754c5b5ea88359410b7b4
SHA1c313ff075e10ec3c1bc13c910f27523c8f70dc4b
SHA256e2da36b3f10918f08034883fb28125f8d6458386c1dbe09d61be8bf8a189b310
SHA5125dae48bce21f39eaa1407333fc2a14db9588351bafef04803e51036f5ca0bcd820d92ee1693bb4da6a1d6e5c4643f298dca6a6868c5d0352fd2d85d17815bb1f
-
Filesize
320B
MD5f746baf31d87e67771c5526e3679d1ad
SHA1ddd57e484d24bfa9e8dfcdc4ac3239673b1a3775
SHA256b18c03cf5705745e22ddd7bb410197d2949bfa815eaf222869e314f65c46c655
SHA5122c9278f593ab22fc250a92b86d6b6ba2b4ab3e918ede07bf6175726f5db40295f66c344813840d24156a68de6a170440f52565f5e70160fa6afbcd22e44a06dd
-
Filesize
320B
MD55f80e8b53706bea8c3ebf22721dfbfae
SHA152ea95f26f5b79e545cd714aea86f1fad2d7924d
SHA256a018bf9c3794d0554cf3e13f17914212ba3f701016912ec6d6257b32483e1ad5
SHA5122c70070050d275ebdc53d4ffbe57ae06aada6afa27ecdf359619241889774447012f0851dce45d106da832c65cac9e4552c3a936041b3b704bde9c117400d8a3
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB