mydoom | d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6

General

Target

d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe
Size

29KB
MD5

7fa918b9015140de2491a9b9cb575d4c
SHA1

72b9124ab41f944490a29b33ab3a7a3a22c22733
SHA256

d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6
SHA512

12ee164619602ec91e686356eca4fcee7fb58225ec63a9908fe11fd05a001cfe2d4bdcbb61acc11365b51666a50a217adf2cb8a1b49d9e11ff7e071f4ed9311a
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/R:AEwVs+0jNDY1qi/qp

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/396-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/396-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/396-65-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/396-152-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/396-174-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/396-181-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1640	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/396-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023c4e-4.dat	upx
behavioral2/memory/396-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/396-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0003000000000709-55.dat	upx
behavioral2/memory/396-65-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/396-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/396-174-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-175-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1640-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/396-181-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1640-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe
File created	C:\Windows\services.exe	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe
File opened for modification	C:\Windows\java.exe	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 1640	396	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe	83
PID 396 wrote to memory of 1640	396	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe	83
PID 396 wrote to memory of 1640	396	d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe	83

C:\Users\Admin\AppData\Local\Temp\d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe
"C:\Users\Admin\AppData\Local\Temp\d0f3bab603e22678d92fa03bf7772084203b5c0f16ff7572b291a29f7e18c1a6.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WQOY74U4\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFE50.tmp

Filesize
29KB

MD5
212ec73c6403d4558f8f9baa319a1020

SHA1
b3e45b5468a2a1e818cfe69ffe91a9008bdcf8a8

SHA256
8ec8803f111f8618dc0c24bda7c4251aec5596e094f460f0c832ad522c04b2ff

SHA512
f293422cb79e7593c2cda627fba4f42938a35a564d57eab43fd023439e54e32f7175b63772e1ddbb8e6a9ed598f490ca55b8dcfb254c8543b072dab717cdc849

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c5db354ddb5d58a42ed9d0bbff0becc4

SHA1
c5c487fc491a30ae2752f0fc6ed149ab485b6899

SHA256
6e6999b5d0e48d58ae1015afa449655633aec7c04062a69cbab13c439fecd7d7

SHA512
56c988c225fa07f2fa691cd1a80ce2c336626b104a7a612472a33ee7244355af3f75d01933761123e2440d14ad346a43b85f43df27cdbd38886608dcf0c54c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
4abfbb8ecae9fd63b926ea24e64b5838

SHA1
4a04b705f089c8549323fa72b8cb8bf95d8f7df9

SHA256
7269261c1f3591d2c29ee89e0e2d5effc5dc8b956a12ac88cb68d241cde0f701

SHA512
f3d45c10e2152b5a023f66cdb4024ebc0133179568844929a322cc267a283668f159137577d14f75abe71b2ac34fca0bbd856e55a883bb7ef0cf967fb5e2e02b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
ea51485509b02b76354d4c66b37cf084

SHA1
96b1c88efcb3c95dfb712879702b84c4b88900f6

SHA256
0f90b2a3fd287c008c71a03a9f13cca0f4248d330dc2895540607ce04dc6626f

SHA512
5c5328bd9e07b599e7eefc1772d7f722adbb7d3b78472b8ffdf03d9cce6785f3cdc09afd7c2c100068e70bbc67a6a238bf37798f2a3d2ed32b61912d60cc25e8

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/396-174-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-65-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-181-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/396-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1640-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-175-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1640-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads