Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-01-2025 10:27
General
-
Target
e23f8b1470418a9b9828d07e9b8445870bce123a9500a367c21cfda6c5b90ee3.exe
-
Size
29KB
-
MD5
3e0376451c634e88cd6fc2472ca96682
-
SHA1
32bdde241ee62e5ce2feea580eea1547ae928129
-
SHA256
e23f8b1470418a9b9828d07e9b8445870bce123a9500a367c21cfda6c5b90ee3
-
SHA512
be87c11f26bbb875f5edb5c8507dce59dd6ad22bad38a094b835b6db17ca18b6df1c02263cd365b3f143f7c0fa253c16ce173fe1ed93ff10b95493d6725ae184
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/yhA:AEwVs+0jNDY1qi/qaS
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e23f8b1470418a9b9828d07e9b8445870bce123a9500a367c21cfda6c5b90ee3.exe"C:\Users\Admin\AppData\Local\Temp\e23f8b1470418a9b9828d07e9b8445870bce123a9500a367c21cfda6c5b90ee3.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5949ce5da6e776f917092eaed018e1f1e
SHA1d029ee053bf04d6fcde8382d6340f46706a6923d
SHA256392c3b8a4816452a6e21d859a5516a7af98896ae2c90996b931b737dadecb971
SHA5121466b40cee336e71de0e622570805bbaa056762935be17e2f82d5eab7d713a181e8355f7ccf150c7f7ea58e7ff3ebe7589f7fa6b7c71a1a0b273d43e49e0c90c
-
Filesize
29KB
MD5f8b1a268b95753a334b0b69656d5c879
SHA16f11cece9df74454a42ccac836bc1b18793fcc42
SHA2562e0f748d485ebe8ae82a3844a2bb9767ee0ec2ce663e07350c8518f82d499170
SHA512e7761c41560ea6d5d4974d3d94a83d1753a44b698bffff089e50370e20d4b5835f11090cf6300e4fd5df22a876a88cedd6e21535070a970e72c10b17cd9db9fa
-
Filesize
320B
MD58daa4ef88fc87ff77d82d11919380ba3
SHA193ebb8a8d495a578d770edf3143ca496efd60718
SHA25652ab1c63eaebe6cc38f137bf508a4e68d2133a20c29335983085274eb7f41567
SHA51249d2370f1da4b2e0cceaa88f1abdf49b84f47b456459f1d29b92ac3c99f59bf04d2c9f8fd3c4e148530e3aab6c68374a0440175de3bc17383a6fe595454de05c
-
Filesize
320B
MD5d73cba17e1c0ccd7704f647882def479
SHA16f1960e65a41484ffbcd05f5e8d564ceb6bbe77d
SHA256c4b5bb9590e8e0981826623b9c293a01f85e473da2b15a7a2fda6c8d4244b5a7
SHA512ade72223e6694fcc6c67ad08c0f7b96f5635fedd96c634953463c7269c214161f1a5f193a17f0f65625df4ea3bb4ed428c832045b5b3dfd004a7a1961d354c34
-
Filesize
320B
MD55f7c852b827f0ea6452867b4a2e88420
SHA1d3be4aff78556e0a78f31bcef4fe219c5ad540db
SHA256f9ac5bf1908e57d87115b2ac763ae5de8f77d0d81173f36f91248d5caf98341c
SHA512b11591d56a70506f7344cab0d933d039c1f9294341ac77b21d83d5811476f140d27d72b91d10c119524588c5582dd9c5dd14887072c66fc766c08452d113b927
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB