mydoom | 6ccfcb2c9c330020046e011d704681bbff0e9741257b1b81ff17398fe6b1324f

General

Target

7951acb3134b30cd16e99c35238108a0N.exe
Size

28KB
MD5

7951acb3134b30cd16e99c35238108a0
SHA1

82e2ee1ced54a1d7ee70e1c6b5e9a51702b33790
SHA256

6ccfcb2c9c330020046e011d704681bbff0e9741257b1b81ff17398fe6b1324f
SHA512

79f9b2f0d39e616569e09a08cb3e7761a947c5731b5fd86cee9bd2e38139e1ea3b555b18e26f3d0d9d36d2b86cfbf58a2cf04c7237250c365f91de80fe3d1428
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNzVy/hK:Dv8IRRdsxq1DjJcqfBK

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral1/memory/900-16-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-38-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-43-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-61-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-66-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-68-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/900-73-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Executes dropped EXE 1 IoCs

pid	Process
3052	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/900-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/900-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000d000000018b54-7.dat	upx
behavioral1/memory/3052-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3052-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-38-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-43-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0006000000018bd4-49.dat	upx
behavioral1/memory/900-61-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-62-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-66-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/900-73-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3052-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	7951acb3134b30cd16e99c35238108a0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	7951acb3134b30cd16e99c35238108a0N.exe
File opened for modification	C:\Windows\java.exe	7951acb3134b30cd16e99c35238108a0N.exe
File created	C:\Windows\java.exe	7951acb3134b30cd16e99c35238108a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7951acb3134b30cd16e99c35238108a0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 3052	900	7951acb3134b30cd16e99c35238108a0N.exe	29
PID 900 wrote to memory of 3052	900	7951acb3134b30cd16e99c35238108a0N.exe	29
PID 900 wrote to memory of 3052	900	7951acb3134b30cd16e99c35238108a0N.exe	29
PID 900 wrote to memory of 3052	900	7951acb3134b30cd16e99c35238108a0N.exe	29

C:\Users\Admin\AppData\Local\Temp\7951acb3134b30cd16e99c35238108a0N.exe
"C:\Users\Admin\AppData\Local\Temp\7951acb3134b30cd16e99c35238108a0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAD30.tmp

Filesize
28KB

MD5
0900f9fa4cb9631a4a2e374195fbb9cd

SHA1
40100e3de011ccf0b4bcc058933ea0ba9c184f80

SHA256
5c2b65d807d4348c201e5b3022d7750411d2e12c98d6a4f1c2c28ac0b2b4ef77

SHA512
5f7c0e722db3377cb0751b531c83a81d4a1740a9939bc20c74ed59120b037662355f5c76dc98f20da547ba69159e7d8a5232ce4295440b26a73dcfbdd690ef3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f8bb0e297e18612753089a0bd8c28d05

SHA1
29d27b2f5b834785340f66ba883d991f403a5ce6

SHA256
0b3ccacb713b0663b73c89f1e09efebd168ec38f749b036ddbc29858535da663

SHA512
224e5ba8a1a9c5b4ecee6e0e23f8513d6e2f29714b492b8e9b1ea065042e8b59fbf7180e5c99d06a44bb631252d300b1d9bce1ad89134841b644fb8ea87413e9

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/900-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/900-43-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-73-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-66-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-61-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/900-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/900-38-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3052-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3052-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads