Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 04:30
General
-
Target
5f644b8f7997bad7534d764946a88cbcb408ed9bbc0c3d08090a8ff926e83a39.exe
-
Size
41KB
-
MD5
6ae78c148db3cabcefdb47f68cbee6b0
-
SHA1
fcfa2a015c0095ab19401be6e9697e9721db3e98
-
SHA256
5f644b8f7997bad7534d764946a88cbcb408ed9bbc0c3d08090a8ff926e83a39
-
SHA512
a14b1e5a6631cce8057dac1911cf28250d4b89cdb0a6415148cdb06f42ab9fe9c8a27f4a7c7087a190be606b1cd16fce9e877b9470dab6a4347e089cfa991d91
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/y:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detected microsoft outlook phishing page 1 IoCs
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f644b8f7997bad7534d764946a88cbcb408ed9bbc0c3d08090a8ff926e83a39.exe"C:\Users\Admin\AppData\Local\Temp\5f644b8f7997bad7534d764946a88cbcb408ed9bbc0c3d08090a8ff926e83a39.exe"1⤵
- Detected microsoft outlook phishing page
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD59e9b289d888c439a4c331f5ea12f4584
SHA125f65ec9e7391988c193e987ad5957407aeba0f2
SHA256a77843e0fb71fd336eb7eb9866c63f600d1210c19c4f65c58b232491b4c51a22
SHA5126d09a37c42f70556b2c6b29548e31605928437ced809fd3de77f187bdac74194c5c3cf164b72252cb09ef11cc27a667527214d72070e373824dd5202827cfaf8
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
145KB
MD5a01c4ff63a3291b0dc84b0c17f7c2c23
SHA17a9a7f91b135bfd8c32bfae591347e978e384f70
SHA256c584d1ce883a6f9ddfdc55499bfc775416341a1500d5fac9acaa8850bc75474b
SHA51259144eac73c8800a70e6c7ea40aa1f05be6cf097f178d7b49c374b876f554f13cb773f76173271b72ede764dd48d78e01a1f0ce650c5a30d7aa490aba1bc80bc
-
Filesize
41KB
MD5629427dc47cb33ca4ebca21022731e1f
SHA100077733db28bedf85e215062bf6f6efbea2752c
SHA256391d211f99780e18f2f167d2825e5c35a60c7f3e114c065ecf5408239b497e8a
SHA512e89e3ee61f3992654530259bd658ad602a186f14661838fedf990a6c8c8019e34a3b61adf3015cd0f09597515d44a46ca7acc38bedd69fea6a254aacd4ae5c01
-
Filesize
192B
MD52c684ab174b29714ffa5be61d84c002a
SHA12fc84df4d5b9e61aecb87cb65bacc7bafa2cf8cd
SHA256612d312233b9396d7011c2f58dacffe9f4f7e2a2c0f7b349576925ce7d4e2e03
SHA51235409888ef29aa96d06b1c0b4c84e960623403b167eb5a0498f0ba3503f2eb7588ee9fa99a24f0bc3979152df3f3d4252dff512e4aae229fefb11f55976908e4
-
Filesize
192B
MD541f47334c87ad1b3130ba7a5faa5c5aa
SHA1dead32aab935034888c52baa2364748afcdae657
SHA256fa035b0c07d8dc5cbf5e4beaa139c3bbf1e96c310d267457e87415fe145e6f8a
SHA512e53d55a3ab89ae394e9b84c1cb27f6ea737b2d51f2bff7c3597afb53e9574727970d0300db02a9eed3ed5e8662b6a879355351fd4c501acdc29213a2cb2a60cb
-
Filesize
192B
MD55c5a0043a0d1bcd9b98bb1a738947aee
SHA1ea1dbd9a3266c013be380b201ee7d49e89be070a
SHA25692fb13a8a9c23c288f89d2b96e038140c22df0cd87f6f58be870bbb8765e917c
SHA512a243bdc0424aabfdd5d98f0ca9c822b3ced819b5ef70a7571dd3950d8f351984caf3700a51e4c1d8d6fac72ed747eb7a0ab98a990dfeb0a12a7479ffe1d57b38
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB