mydoom | 67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4

General

Target

67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
Size

29KB
MD5

f4ab0f3ab617a2cec565ab304605546d
SHA1

249557bf415d6bda8430293428f3b61ec777f18f
SHA256

67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4
SHA512

99b50473f471546a08804c7c6f1ed1f225fb93302bb632f3c864ea624c25451252ecade5458ca91c443ad19398c703c467ffdeb1d97489c7eae9f25f457787b1
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/q:AEwVs+0jNDY1qi/qi

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/2880-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2880-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2880-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2880-141-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2880-154-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2880-161-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1640	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2880-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023cb8-4.dat	upx
behavioral2/memory/1640-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000e0000000219e5-53.dat	upx
behavioral2/memory/2880-141-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-142-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-154-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-155-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-161-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-162-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
File opened for modification	C:\Windows\java.exe	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
File created	C:\Windows\java.exe	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1640	2880	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe	83
PID 2880 wrote to memory of 1640	2880	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe	83
PID 2880 wrote to memory of 1640	2880	67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe	83

C:\Users\Admin\AppData\Local\Temp\67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe
"C:\Users\Admin\AppData\Local\Temp\67c637aa4ea39fb862cd97d9859630b286e4eb4c6a94cd991f08e62b24564ab4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBFE3.tmp

Filesize
29KB

MD5
ebcb3faef05e626f654d047225672f46

SHA1
f35a8d641ed2d655f89a29548508fd081212124e

SHA256
826c69cce310f22e703a6da89a7de571e6ed9bd051500de58d1cc07ce60e28b3

SHA512
db39819ab0198c4ba4c81363467243e57f50f41f8e75a0bf4bb539714d360db437b4f68e39d1506292132742f2c33401e67565acd652d0612d83915c1b1a838c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
10afa21ce327b984ff551eb3e224f7c4

SHA1
3238f84c069f87309d40cd37edd0edcc1b4fcd49

SHA256
a153bfc2127f5b2f9f2c80a84f8570657cf9116e37768f9d5000aa3489ca1306

SHA512
f38520cd458fbf8a040a4bc9c1510de4eb552bcc03134ea229aa0405bbd62927cc087deb464238c27eb5fb8acec1053a32ba1771702964ff0efd931bc35bc835

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
a7bc685a144aef275040148d88ae222d

SHA1
abb97a93417c495f0c87374170219ac2830098f1

SHA256
51c4f249d0e45f240aa5655dd1b6b3c2d87959b429b10e31b8b274dc6ad13b4d

SHA512
1c3528af8622fd838a93b5e4dbc7373ba23788445e39d37bceb90d8213beaf2b8c863f0297ea15da76c892d3b0c088b579e58ba41e5aaf69b4867d7c2656c5b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
05472d15fc8e311bd4136bd88fdc80ea

SHA1
69474e3cd0f06806ef9056e7263f9bf7fa0c7840

SHA256
207a6e7438cffaf9f6529662be3d9511bd59de5e93002eca37b8330ae8e0ee61

SHA512
ff6a3f5d66db51f13d18cb374074886f077e3c647b3129f9c86ef3bb53bd1bce71df413bb6f89f6eeb665cc9534fe6400e013b0604e7412d8efe7fe8cb5cd3b7

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1640-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-155-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-162-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-142-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2880-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-154-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-141-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-161-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2880-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads