Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-01-2025 11:38
General
-
Target
f704be08a964f000beb56e51f5ce3d346536449072dc1db9ca035b8e1bb456b4.exe
-
Size
29KB
-
MD5
ce136a891e1ebaff703c3007370553f8
-
SHA1
36bbd698bb9517732fa7ee48f7d24ee78d690183
-
SHA256
f704be08a964f000beb56e51f5ce3d346536449072dc1db9ca035b8e1bb456b4
-
SHA512
5a610b13d778f9c6a13d1ad98891a0a153e897943101b5043c90e8e4ab7e6e57051ac2f4ee1720361a6b0e7785ba87ac7d61c3ccdbe394a35efb5b4b26acc3e7
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/thp:AEwVs+0jNDY1qi/qlT
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f704be08a964f000beb56e51f5ce3d346536449072dc1db9ca035b8e1bb456b4.exe"C:\Users\Admin\AppData\Local\Temp\f704be08a964f000beb56e51f5ce3d346536449072dc1db9ca035b8e1bb456b4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD59037804ae5dd8f51f8125cff102103d1
SHA180c9a471a66e9177318034dba859d0e2d67014f3
SHA2566c16f1cb89c114cdb41f613766553a5ed4a7d693cc7a3d72947857bfaefc53f4
SHA5123b49a71b024e872423d77218cd6711fb9c6b523b76c4ed3f401be3b8e6c0f5e728bd969374f5ca1c78b9ba91d05cdaa9aa8666454f4eaf4347f55553945416b4
-
Filesize
153KB
MD53cb7a4b61960a46537c96c35f3c82995
SHA11864bbe8d9ebc9ae43b6955810446354680c4d83
SHA2563315365e535ac73bcec97c22f90f8f81a50e1048f1ce2a332b92b334cfcc0ad2
SHA512c0e8693edb4d29549542b19f943e5c2e53fa430dc4f1e4afd0f172cd002c47e43e350fa67d66ddfefdd593b1866304269a7db27142d27c6462d6cbf7e4755f57
-
Filesize
312B
MD55431b34b55fc2e8dfe8e2e977e26e6b5
SHA187cf8feeb854e523871271b6f5634576de3e7c40
SHA2563d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
SHA5126f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c
-
Filesize
1KB
MD51e9fcd86233e9dd64fe3ede39cde9488
SHA1c66ded700b8f007ada5d0e7da3403b46fa43187c
SHA256a3d1c0671be23488874db9266892cf3dd4fa6245e3f3aa820bb3b7fc3bb26c53
SHA512e9c44c04ba854a7790012ef61561b67ad49066e9279486358076ad58217c3b967a0c2728360c73c2bdb108e92d272a16e5d9d108439a699853bb35c533366b80
-
Filesize
118KB
MD54f6c06c530b5cd15a1b39552c823bea0
SHA1b88c75f9b80d1c36df8c9235db95a579691b5c5f
SHA256fad09495a58efc9d07e316886696d234532f9b34bb96ce59bf4164943bbda57b
SHA512640f68a133278037236e454f94f924bc87fe0337877399292f0ae5cf9c08fb8c1e57c5776acd30374a850b424ba186415176c09ca1f3c8a49773cc56fb6d0b4f
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5b1dda5aa4d9986a721e989c5face764b
SHA1c1ddf0b62b4c78f260659781e17171b228626841
SHA256c032e990afa42c753da485e4851e12a5684ae08ada932fdade81f2cbca43c66a
SHA5128c399c449edddfe76b4040388b308861132a122665a702bb11830239337dcb9d4046dd1953515753f4155b47d83f78eca43705fc60f5e80c56c189fe1ee42e3c
-
Filesize
320B
MD59ef56f85b7fd62e8b5e0ee8f50dec114
SHA1b31a0575f2f5e9bcd6b80d6297c68df6f2bc244e
SHA256bb8966d6661464a8d07339903f60a8b4f3ff647d4df9152f31182ac890115950
SHA512dba1c859b60a21b580f1c7c6233aee1afba9e2c34eecb9db38f27d35fab59f612dd169e0d027d0ca2ce1efd8ac507c39d2d15ef306dc59c7ccb624c9c3b53475
-
Filesize
320B
MD5c0de2fcdead2518f72063530fb9cc679
SHA12b015784609373684a6bd2e7cb5215d4ec88027d
SHA2560fbfa0b360676ee74843b9f06e867ee76f20a924f1907ea77b96fb334470d6bd
SHA512235d454304d9c9c2a0ee0052cc527e5cf080ddc5f21b2c570aba1e23447effc4504ef82ec9a6474094a1c4e7ab0e89df9f0d743ce62b4cd9bf16e79f5ecb8499
-
Filesize
320B
MD56119055ea25577dc320e2187d5dd84b0
SHA1a5f13c38bf1a31e68899b6b921bda1a9ffb1ac88
SHA256ddf6fc7735cd22e1b387f468eb2880c8c6e9c8296f8002f63289eb1fec34fb5d
SHA512f71deec2b14950368b9af7846db69f05ee426c6e79b8158c625e0ca25777a142924377712c7fdecbb2ac54d324fcb9923923c2e9e822f25ef912d1a6d3d2ccdb
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB