mydoom | 2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
Size

41KB
MD5

8092edc3a1a1218bec0ff5034df6f1f7
SHA1

27678d394f934cbfc9c579628141b6798c32dfad
SHA256

2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce
SHA512

2c99d8548ee25560633c10e13ee72d50b0f6bcfbb2ce018542958b3c4976fd3401b79a22fc0e52a4862394882a91f28061e41a811fd04c0eec463a1d9082c2e0
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/2196-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2196-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2196-136-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2196-169-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2196-175-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2196-192-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Executes dropped EXE 1 IoCs

pid	Process
1104	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2196-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000700000002360b-7.dat	upx
behavioral2/memory/1104-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2196-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2196-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x00050000000004e7-55.dat	upx
behavioral2/memory/2196-136-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2196-169-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-170-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1104-174-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2196-175-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2196-192-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1104-193-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
File opened for modification	C:\Windows\java.exe	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
File created	C:\Windows\java.exe	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1104	2196	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe	90
PID 2196 wrote to memory of 1104	2196	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe	90
PID 2196 wrote to memory of 1104	2196	2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe	90

C:\Users\Admin\AppData\Local\Temp\2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe
"C:\Users\Admin\AppData\Local\Temp\2b2b94010b5fadeb8f07564f3dad61d5c321c1e12fae6adddf6e1c69c10776ce.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1012,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0KP8BKDN\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BKKBWXOR\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCPU4OJ5\default[1].htm

Filesize
304B

MD5
267ddfdbb8d492b25de208d84b290f1c

SHA1
9f57d9f19f25549e1232489a0c101a92e851de2f

SHA256
ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586

SHA512
0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD7F7.tmp

Filesize
41KB

MD5
68aa0f8509b63ccd866f5c1849b617cb

SHA1
2da0476b311d42bfc5e5cd96c4d4083f021d832c

SHA256
301b95381cdcc4a4311fa03b7cdd815006432b888adeaa94d21e6dffbb503074

SHA512
d6b2ccc7f1e4468d5b733764773ad7226d80c1359773b59e59d4a64f8b56bf723980c95231a2360fcaffb97085eda07d8696eea8ec1de0eeee338748f820f848

Download Submit
C:\Users\Admin\AppData\Local\Temp\xavnwvdnrf.log

Filesize
160B

MD5
6eb1355249794dd68f9f6809acbc9718

SHA1
e2a9913b77f66b40f78f2c5e8af4c951c864f1b1

SHA256
17e260e5b49e9d0a8dc84c9e729ca3e9b6d639273d573aa10af4f13ec9160d2d

SHA512
595e907e76004a389c70cf009e7b0f9b4d34244f87329ab1c0a516cc833ab8321a390a61b90018f2f19b2487586be2fd6fe5faf9cde60828d71a7b4f3ad22512

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
17473c0ec9e5ef4256d6b10feb7cdfc8

SHA1
b867ad4f8e4a4e3b55492fa165b1953ba7ac6b43

SHA256
b2151f472a44b9fb6149d512d3523b81ec5d6798c18b7f470b31f2748d9ccf9a

SHA512
a6e527ccb2d376725662ec5d9d6846b987e35caec9f0c28a32d61373e6eaa6f8382a5ffbb75f3d00d0eb172ea1c256e97581df3b209a9871313e8634450691ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
31cffdb3d0f51e67af55f9efda0aac61

SHA1
292a1aea712b9d09f53f5da269194e8ab966428d

SHA256
3da4a1cc7e2dde4fdc10e1802a3ac6536b7b27fc387bd9c465cf69dd32daf67d

SHA512
e536882fd826d24f453ae3ac8c4306ccb473f79ec178e2ee01a350134b707309fc37b165dc7be5e472cf442eecc76b56410433be54cff746bb2e7cccede06d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
0cf5f8f98979b7af23cd10fd48a7f50f

SHA1
694737c7561cbd6afc7694f701c3959983a3e1c5

SHA256
011c857f8fa0fd204e61ffa786889895c72ca13099137316481f5b6c4a8b970f

SHA512
8f9c05b50a0daba51c34a88361c7cb5608517a7a7b68ad1f1db912b98a5cac9560adbc3dc20e7ad47b70fe27d26a1985d07926651f5c6f22ad3a3e727db58c25

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1104-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-193-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-170-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1104-174-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2196-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-175-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-169-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-192-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-136-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2196-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads