mydoom | 195688fdc5454fb7f6ba8188015e395bfe86876a9c0e28b818944ee264f0e77c

Resubmissions

21-08-2024 19:30

240821-x76q3sweqg 10

21-08-2024 17:42

240821-v92h2avgpj 10

12-06-2024 16:01

240612-tgps4a1bqh 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Size

28KB
MD5

6cdec3ccff3c2a0c2602bc89443f865f
SHA1

cf7ac47ec2e5b261786c9c11d30a09050bf459be
SHA256

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5
SHA512

c97f74a3486b1018c2413473a82ca9d1f777c05993c4b3da4adca0006165107c2ecd14251f77e3cfcd8ea3949f64332e35e43648426f750aad8eb597f87370bb
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNanRiEMnY:Dv8IRRdsxq1DjJcqfFRn4Y

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

Processes:

resource	yara_rule
behavioral28/memory/1660-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-39-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-98-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-149-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-151-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-160-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-181-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral28/memory/1660-199-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

4240 services.exe

pid	process
4240	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral28/memory/1660-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral28/memory/4240-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-39-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpDBD6.tmp	upx
behavioral28/memory/1660-98-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-99-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-149-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/1660-151-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/4240-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-160-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-161-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-181-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral28/memory/1660-199-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral28/memory/4240-200-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe

description	ioc	process
File created	C:\Windows\services.exe	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
File opened for modification	C:\Windows\java.exe	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
File created	C:\Windows\java.exe	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exeservices.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe

description	pid	process	target process
PID 1660 wrote to memory of 4240	1660	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe	services.exe
PID 1660 wrote to memory of 4240	1660	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe	services.exe
PID 1660 wrote to memory of 4240	1660	510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
"C:\Users\Admin\AppData\Local\Temp\510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H9MX5QVK\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQ3665LB\default[4].htm

Filesize
315B

MD5
e510f9586fd45ddb7f0c00cc01b5bb78

SHA1
0f49be1ea6f9228f7fa5877a74df5913d500f44c

SHA256
06dc56e918b87be102dbef5a82c2b9e572d2e4dd4e778026ab8aa59ec58c454c

SHA512
4a6cd27994a9bab95b152bd6be520dfa186b3b067345a350ced80933757ce875bf53cdaf3413ddf1ed14968adc233f7cb6bb2fcda0fa19c4d68e2e9d86416b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDBD6.tmp

Filesize
28KB

MD5
60b00cb26177a9b5021a39e90415b5bb

SHA1
f7be2e6296fc061f8897875968fbc6bdcc27d9b4

SHA256
a9bcc42b9642c2d3082ab3efbe508ff92190e62c0df14a7a8ec14cfc1332a780

SHA512
248846e1acdc152fa64a3c0e0c08d816f4fc1946b31889fcec42881cacaa57b50d04428c2d4fb08d8980f9665f387450cfc483da9e5efe54f0eb94cefe11e0eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f18b0a20c6db7d849c8ec5cc30903f19

SHA1
80f08c64f6e8c2d29292dba7aa13a71b43172294

SHA256
b8c0b3797d9f63d57084d6632a1cf411cf9ee221ca3e5ee623709bc73f5faf8c

SHA512
86210341f2231ba8e7d74e6bce5e88509a4b4e024e528efc35dac794fcc7aa9fd8107d9da91e80dcd643f3c38e97189ec62dd8ec3fc27aa05c1508ad68fedf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8157883b7f9b429b24e58bcc3e415a0e

SHA1
1230e54e103051b41178bac932fe356f8ce35f41

SHA256
ee06634bc9f9add8d48835969a0a0ee97b5fcfcca61e412cd480920b12af4c22

SHA512
c58a72f421d091588efa927ed092399aad147096448d92551739b543d4141a01a6e3fb0ae029a0a731461702b820329b806a4ef6d0813b5939bdf7f45b7f6c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8f37be3fa896bab32f5d549013f5ed87

SHA1
be1419df504b089aef068f172a3f34095c5fcca0

SHA256
51efc08547ce7cfa6492bc7b87cbb84cf2f162aeb15d5fd3f5937842d7d1a523

SHA512
06220621e1432a00afad34f6eef179e3f213a1822044d0509d70c70306a68279527a77bd541b042ea72003d1e76b5e547b4fdf3c40151829b7ddfa7c4b816da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1660-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-160-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-151-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-149-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-39-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-181-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-199-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1660-98-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4240-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-99-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-161-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-200-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4240-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download