mydoom | dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391

General

Target

dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
Size

29KB
MD5

74860b2ab78e515ad67a9c7220d28680
SHA1

6237273b6232f42bd517b8d560a77decd931f01d
SHA256

dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391
SHA512

e467705fe06666589ab9a1b9d391f3955fa2e76dcf6b4143a71cbc0672337ac68bab8396b6363aa7c197b2128d5207116d8af417d616852536bf6feec5fe1360
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//p:AEwVs+0jNDY1qi/qJ

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/3780-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-127-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-164-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-170-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-198-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3780-238-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2648	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3780-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000d000000023b9f-4.dat	upx
behavioral2/memory/2648-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0002000000021f4b-43.dat	upx
behavioral2/memory/3780-127-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-128-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-164-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2648-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-170-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-171-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-198-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2648-199-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3780-238-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
File opened for modification	C:\Windows\java.exe	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
File created	C:\Windows\java.exe	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2648	3780	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe	83
PID 3780 wrote to memory of 2648	3780	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe	83
PID 3780 wrote to memory of 2648	3780	dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe	83

C:\Users\Admin\AppData\Local\Temp\dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe
"C:\Users\Admin\AppData\Local\Temp\dbfa803d9831ee84206379f70f309cd60e49b71828eaef7bfef31ba44afbe391N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\default[3].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfwPe.log

Filesize
320B

MD5
a4fb70ad68e3a0c8e9933179464d1367

SHA1
8a455b25b8ac17bd56bb7d13328ff3d67ab5dfdc

SHA256
fb529dda473ceb4bfd24d7097e144447f084c94edb7934cef09407db92810c5b

SHA512
3bc6e2739aed27679417545df8fd644b40a9cc500877f949189eaa61432ca7e570684e7bdd1364ecbc8bffb09d5517f46157c82f6c459cc13b7e30086ffc92ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7D0B.tmp

Filesize
29KB

MD5
8a7d7851dfde0502b3857a4ddec2a0e5

SHA1
44033c7cce6ab1362dd9d1c21203fcc961e8a5d5

SHA256
c5b17d7b4b4b0bd94d285e298a232c1b55db8d88ca2fd430a628ab70ea35867f

SHA512
59e0f2e922e1b8e7ae5ab33fe246026cecb6f724632b1d00a93564b23890ea234a2f826fd13443d0f0238391a5c2e966e6c172e86d0e86dd87652313a69b20bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
42a150c8604214ac689396401f459948

SHA1
3c4a37235f839fd6502f8c9e313a2715679774e2

SHA256
4d747c30a17ae680c735471616f46d3fab227324ec24d887657e48747a9726dd

SHA512
03a003599ecda123ccfa28441b1a5cf279e9008cfaaca76c3569f70569417c68a288c641bfd82a1b0343525967cab9854ea84d8809854dc061096f577a4cd87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
2a0b22c09a94dc055fbc802aeda5f51a

SHA1
05910207257e966050efd1e1cd7490feba2d7cc4

SHA256
4c53fc06d289e7c0d9344670a033c6ca6d43fb9c5ee76b802f8c7aa560d24cfa

SHA512
08069afdcadf22649cfd0b16192ccf23d1c6880ce80c3092f78f14aa058189fe19c30cc3e6b97e8bcc2ad5376f8fa4cba1eccdbcdab9bb6210cb40e00a549c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
94f159f9e6ab739cea0a21c989d160a1

SHA1
67fef5e30bc1a1dc87437468aa63a4806f16eabb

SHA256
178aa89d7eee4f2f5f81aa9d766b34f3e3b1deef8329924ec9efe8498b5377cf

SHA512
40e09e1ca8ffc6cd173b108a18f6ab16e65d921e1d2a443b8642e661242127bc5ab85408157c90487a4b504d290f6618a83d80998d8c5f7d8413019c5b7c322f

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2648-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-199-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-171-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-128-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2648-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3780-164-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-170-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-127-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-198-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3780-238-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads