Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 15:53
General
-
Target
32a1e77614fe43ce08c1f14a9ab0c2fd20409f16c43d47994cfd1fba0bec949cN.exe
-
Size
29KB
-
MD5
6c05efe095f44d7a90d4956df1c7bbc0
-
SHA1
15d8fb6a916ee6c1fec24543dc1411d81ddf5a89
-
SHA256
32a1e77614fe43ce08c1f14a9ab0c2fd20409f16c43d47994cfd1fba0bec949c
-
SHA512
23d0a559e1ff454eb7fac0fd2a4c24edd8f279bbfd99e660e8ee7382bcde645013f6d51cd45ac6a1e3288189d7fca5cfc89e92967c3f21fe1ac9df18cf965313
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/7S:AEwVs+0jNDY1qi/qm
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32a1e77614fe43ce08c1f14a9ab0c2fd20409f16c43d47994cfd1fba0bec949cN.exe"C:\Users\Admin\AppData\Local\Temp\32a1e77614fe43ce08c1f14a9ab0c2fd20409f16c43d47994cfd1fba0bec949cN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD52fc0437a108fa360971da6ee5ebd16a6
SHA1ac1bc788835887fbf9fddc780aff654a6bc528ce
SHA256332c687c9dd749029e674fcc8bd2cbdb9a3b7e31f52a2044453705f613b3856e
SHA5125e4f101d757612a2dc66b02d1797edb5807d60b9153250f119e1bf68ecb90b0af8d9da093bf5328d040e1a29db5e3cc9fd51b1dbca4cb581092ccdda825457e8
-
Filesize
352B
MD5033e79ccd59f969d0e17b33b72e5b032
SHA1680771a0464c751e32b4fd238b02167bfc7fbfdf
SHA256c413ebcdbc0f40018fb2c1f2c5bf6266d5d88c9995bf58631c15fb174baf756e
SHA51216d7f2147bad0dfeddff654e29d4aac6f75ea5bc214a1ad16fc71df8ae93b526dbfa25be9502cbfd3fdba0a06f48a1a109deaab63bd7a4adab4787ce6e23374b
-
Filesize
352B
MD592717348a0311d276c0b1c1fd9512318
SHA1c627bfc327578350659cf4fe67e0afcede56a40e
SHA256e7568ffc315448c4fe2eecf8ccdd50c2d754e4a3b96bace0eaab28ef5b8ef92b
SHA512e94637c4c71c923cf3e6351ab28459d075cb2ceb5e5b65ad69437145919cae9847af5800f0d29a9136657dc1c67c558c639be6ad05d6d6dad0651bfc4bafe667
-
Filesize
352B
MD54d05bb668d2084fe8b98b1b0dc5e2bd1
SHA1a0bdd29d5de6af7e1fbd628a08754034f1510c16
SHA2567fb4954d6d593e030d5c06df22e90c28e860dc2583f48f512f7ea11b41ff68e1
SHA512a927a5301c7fb9f4517dca77684c8d6801afd164701fca6fdaf67e6e873ce668c992638acca3b8a1022ce4bdd5904cbc40e9b5d5ee239b1cc44c0b43b2c700d3
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB