Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 19:53
General
-
Target
0a558eec32e2263136eae954d19f42af30deaf50d7da098121f64e0fc8f2c4e0.exe
-
Size
29KB
-
MD5
118962439abebd6bf0d8482940378908
-
SHA1
fdc6af4e338859bd4669f133d78403567a003d3c
-
SHA256
0a558eec32e2263136eae954d19f42af30deaf50d7da098121f64e0fc8f2c4e0
-
SHA512
f8d039bce10ed88f084576a6ecf64f7c3bc25ae9fe3586229eaa4d95b1f6c2124e9c1b2c831ad7d232f9d0f7ec78473fd47f2bacbb1b17982e859851bffc31e0
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/GhQ:AEwVs+0jNDY1qi/qum
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a558eec32e2263136eae954d19f42af30deaf50d7da098121f64e0fc8f2c4e0.exe"C:\Users\Admin\AppData\Local\Temp\0a558eec32e2263136eae954d19f42af30deaf50d7da098121f64e0fc8f2c4e0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD52004f240dc778b870bacb2e35b5d0de5
SHA1353a92068a145576796682cda7ca35296cafc7bf
SHA2561c5cb641090a7f3e307cf23d1b2b65ab7a5276a90682cda6713c8957ff9d4269
SHA5128c7f0ad6f44a11b001cf849d3d34b8e83e556a6912b59342ce87d697b4ca10a29f357b0ffe3f453db751a13317749aa6d788042cabaeb0090a9c8caef73e8f0f
-
Filesize
29KB
MD53738118efc154bc08793f4152912fea7
SHA135125def670741b88fa3569e8742034ed9f8517c
SHA256cabde50834e4a5c23119dab7acd451d0c0873e772a530cf836da9a76f697cdc4
SHA51263e99927989c2746cfb2083e1c98e2b923bf6c69922b4b54111d8dcf4ddc8d18db57e1134c2c25ea3adb8f793fcaf1fc5593a642162b65323758ab447ed3726b
-
Filesize
320B
MD5b4f27946e9073c7299748758368a6703
SHA1218d8d21ff6de105e0afc78522f73fe5a11b9d53
SHA256fc56c601e0f8674f59464f68b29b07d7f7849e15a349372360944dece06fbf96
SHA512b6a1a3b9315a66c54d905d68c80c1f309171d40a484bb17751381894952af704a9de6211a2162e9eb3ff098f6ab3bda536b94fa29f80a51659b10a4e66cc5ba6
-
Filesize
320B
MD57852b145dd6e7e82ec90de7ce985160a
SHA1fe4111132fb1f855c49f865fb8a4b125b5d5615b
SHA256bc21c27fa7fa79a71d81d34ac49bc1b598ee48fb50badd5898c8bf5c63679f41
SHA512de76b7e469c996ac734a2035ad03cff7a137c77e863a24462de47001e818e54fddd2ba21fcb767a4c589155387eccd989f31f8c1a7092393e5436fb0275b5193
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB