Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-01-2025 02:15
General
-
Target
1712e60e5b2ee5bc72734a8723ff7a5fb910887f655d00a531782a81d62c4a14N.exe
-
Size
29KB
-
MD5
8e65f9c2c306ca468aae411017c66840
-
SHA1
4e804e7b9425676d6da1335870881c2726764de7
-
SHA256
1712e60e5b2ee5bc72734a8723ff7a5fb910887f655d00a531782a81d62c4a14
-
SHA512
a1526b38580c8da381e75dedb40609230c6cb5a470118a7f714e46f54c2e618ec8a3777268ff16d96e69836df47881d26125123f2752b21dabfcc3fc41e56388
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/O:AEwVs+0jNDY1qi/q2
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1712e60e5b2ee5bc72734a8723ff7a5fb910887f655d00a531782a81d62c4a14N.exe"C:\Users\Admin\AppData\Local\Temp\1712e60e5b2ee5bc72734a8723ff7a5fb910887f655d00a531782a81d62c4a14N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5ceb8feddd6904f0aaad6b07d7f443555
SHA11d194beca0ab88da2f22763ea086321766700ccb
SHA256b11fda7eaa82b33b9e5239fa87e6d7f16d7c7f410d25a4c836a97c85d8c88778
SHA512b33fd692be3f540853f7d3ddb6210fe610f30d87862cc64e8448ed992ad890c547abba64e22d87ac5970327942a980beebd33eda942fefa9c89cd8434668b0ee
-
Filesize
320B
MD58fa36f0cbf738ea2f2aca610cb5c94d9
SHA131d76dee235d84d03198320696e903e7de3c0226
SHA2569e31c8a16fa475cbaebf669e639d98d81d2944563e0c00a4c3ef46aa592bfad9
SHA512812ec46b66d420453f1dcfeb9ee983761a4faccf54506cc5b284f566fbc6ef09cf382f22302102babbc05d36e5afb92055a2db868eb5dcd2863d86d88bcf63f5
-
Filesize
320B
MD5c5c782d4837f0e33e3ef40cec5034c1d
SHA14777bcdea2b92daafc4db333c657d075e06f1141
SHA2563087bc4f6ff57160304668bd2a74b98924cf05337b9bdea4324a13676bed0a0a
SHA512454230624bdad54317b362d067e67ac62a9f3de225a47eeb7359709a6381231a6c23119b8bca30bdb2a1e6a500a36144a4108676cdd0e8159ef54707be4df035
-
Filesize
320B
MD5d997818d4916cb06b263fbb96d5f6205
SHA1b6eae47a39770beaeea015d6d4357afd3532bcdd
SHA256bc366dbff061e30e2ea065457cc30a1bbe5409800a0f3d8d1fc4c611c3d66746
SHA5127e90021a54906a63f820349bfff750f1f278fbe442002f7001308681c1304a240d19fc870894d5518ca45f35bc566d6766fedc3b76564d052a47c68007cd4e3d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB