mydoom | 00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291

General

Target

00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe
Size

29KB
MD5

7942553f0a364970f8068e5703265af0
SHA1

9a1cbb56596725ee8ee69e80a2e11a78be9b0e8b
SHA256

00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291
SHA512

12133ceff791577eb68a74db34772c111f2e5030f295736f7698b8950aa96fad57b1c770927f4fc53aced50d8ef7fca1b23d05791a8d256620c5eff15302a781
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/o:AEwVs+0jNDY1qi/qQ

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral1/memory/1644-15-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1644-46-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1644-67-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1644-71-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Executes dropped EXE 1 IoCs

pid	Process
2520	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1644-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000800000001944d-8.dat	upx
behavioral1/memory/1644-15-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2520-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-47-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1644-46-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2520-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000013d08-62.dat	upx
behavioral1/memory/1644-67-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2520-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2520-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1644-71-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe
File created	C:\Windows\services.exe	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe
File opened for modification	C:\Windows\java.exe	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2520	1644	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe	30
PID 1644 wrote to memory of 2520	1644	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe	30
PID 1644 wrote to memory of 2520	1644	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe	30
PID 1644 wrote to memory of 2520	1644	00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe	30

C:\Users\Admin\AppData\Local\Temp\00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe
"C:\Users\Admin\AppData\Local\Temp\00e08c44201f2dab26fc10007aee2f12b1c62a8e385dd9099b77c7843642a291N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\blTauEkyb.log

Filesize
256B

MD5
bb9d4c72f0efc0b70ffe268d6ec20354

SHA1
945cc7f4352593a82f1d46774a5c164c44639e7a

SHA256
fc0f41277c13b9dac411c1fb848a714ae095e622a044cda041ef6eec137dede0

SHA512
fc8de986879d16124b652bf725d931953a3490924ee997458c94a1e6ec16a8a3bbbfeec78cc08a2adb7e42c3a78ef5f3a7087eb4e50ad1085f4b5b6872e85161

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp10B5.tmp

Filesize
29KB

MD5
d6e308079f78f4d905bf31d7991d7b8f

SHA1
94b66519c3251b4f3ac4adf204ec6fa31be5709b

SHA256
dd2a754de148149dd73c1076a9c5f408facbed447e674f564c48aee29f80851b

SHA512
bf9c59b2d0b13c84f9446a8a418b306ab5d0bfe82cf225f157b0222dcf2418fd39d852c833feb30ae961de2e00b2c9e3b4c5989bfa4ffc5844e50a97d4febf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
35e925ced420c9d5c412ce5dd64df3c5

SHA1
bf40e618764330ace3fc08ba60b6de4aa098d7a1

SHA256
44bbcd1835392216a0829427210590d696def1fc018f5f5b9c03a613bd23132f

SHA512
869cf375d70820f58a93a5155f7974796aee80c72648d38c37de7a6c63c7b162e0a8ab005132552379b88bfae907a3d20fd8afe789b980efcdc93469e4097bf5

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1644-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1644-15-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1644-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1644-71-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1644-67-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1644-46-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2520-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-47-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2520-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads