Analysis
- max time kernel
150s - max time network
175s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250207-en - resource tags
- submitted
10/02/2025, 04:34
General
- Target VirusSign.2023.11.29/04c187920db980d8db16c5acb58049ae.exe
- Size 29KB
- Sample250210-e7c5na1qhs
- SHA256 901cb61d59c7292bc8dae4a997c10fc46908f7cdb1bffe7b4df7a868459aec88
Malware Config
Signatures
- Detects MyDoom family 6 IoCs
- MyDoom
MyDoom is a Worm that is written in C++.
- Mydoom family
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\04c187920db980d8db16c5acb58049ae.exe"C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\04c187920db980d8db16c5acb58049ae.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTI0QjlEQTUtQjc3Mi00MUUwLTk1REQtRjU2NkJBMTc5NDI3fSIgdXNlcmlkPSJ7OTk5NUVGQjAtM0I5NC00M0Y4LUFGNjUtQjNBNTczQ0I4Q0NGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEY1RTg4RjgtQzdCQi00QkVDLTlEMzktQTQ3Qzk1NkNBNUUyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDE3IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NTg5MzQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTM5Mjg1NzI0MSIvPjwvYXBwPjwvcmVxdWVzdD41⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
default[1].htm
search[1].htm
tmp6D7A.tmp
tmp6E48.tmp
zincite.log
zincite.log
zincite.log
services.exe
memory/1164-150-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-12-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-168-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-135-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-0-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-49-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1164-81-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3660-15-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-136-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-33-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-50-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-45-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-40-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-82-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-27-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-20-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-151-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-164-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-169-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-5-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3660-25-0x0000000000400000-0x0000000000408000-memory.dmp