Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 09:22
General
-
Target
fad94149b671fbac0d831c7f14ee5386425034caff0d071138b1d1b03a758d14N.exe
-
Size
29KB
-
MD5
dc1865071d16fcb3cda9cab83b0ba820
-
SHA1
215c7aaee636f959466b1f4d7adab6a0c84e961f
-
SHA256
fad94149b671fbac0d831c7f14ee5386425034caff0d071138b1d1b03a758d14
-
SHA512
e0d3bcbefaf4b65444492505c2cd20a60d4d2b728366023118a3bbfbedf4e73d3f6a75ba5873a3002713738348b8376e9b8fc8dc57a6129aaa5838925a9ab1ed
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/uhs:AEwVs+0jNDY1qi/q2O
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fad94149b671fbac0d831c7f14ee5386425034caff0d071138b1d1b03a758d14N.exe"C:\Users\Admin\AppData\Local\Temp\fad94149b671fbac0d831c7f14ee5386425034caff0d071138b1d1b03a758d14N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5f47891c28da9fb5ce6f0de0512ea9ac7
SHA1e529b4cabdd862d132a191338d692ff4d8257a43
SHA256f8d1a25e60b4cbf7015d0250d417a5d734412014cd8c47f86f1cb0383c5be4f8
SHA51299d639e2d875a54eb8a83e101691e451fa463d0b7fc984f96dbc1badc88aad940cb85ff1c663ec2b91ad60b1aa45359adb0efc16e67dd4daec1cf9cce113020f
-
Filesize
320B
MD5ec1bf769c604d7958342b10550e6ec1d
SHA10ed8f5780d1689e8ae66d82c015ff410301bf552
SHA256f8a674cb2bc036a4418eb5df769566abfbad4150f3e9726e7c93b7ee004b66de
SHA512525bf618b9434bca2928b031a4c4954fbcb5f252891fe4bce57e60f1f18513f15f8c59213057465084888eaa5a975bb9744b9562f8ffc17d5c119f0cfae2f6ea
-
Filesize
320B
MD5b9fce575e20fa776aaa4e6c3483c8efc
SHA1e1f9eeeac83f05e0cfc327cab2f56eb772942395
SHA2566d0201eeb28f5407ba3be239118ace7c31ca29ac8fce1923e4491406e38eb98a
SHA512e8ee4526a29c80862398a8ecc9348ee888abb451d0b83bc942eaa00d91e125f8377df96c369c30df5b5c7f897379cab14d92dee20e6eeafd245d5f450151774b
-
Filesize
320B
MD5a6c1b869e5bbbb8ddc1983ef8985bbca
SHA149e5aaca7119894222cc87fcf23cdaed2440bec7
SHA256d26034b3b9c229514665b84ece7a49f8f48a1a533c18ddd6c8820f17510d16ce
SHA5125df23cbb92f20d2e0668c3404299e4d77d36d0438f269a116a14c3a7870fdeb61730b1897272dca16631306708e98637a8287ef1bc20bf768ba938591c2e9866
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB