mydoom | 2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411

General

Target

2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
Size

29KB
MD5

352302baa5a38e526da7e7211b86e68e
SHA1

1bb2f81facf650bb757a46212b1558cfad9b702d
SHA256

2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411
SHA512

81fda557fd029ad954083ed32e0aaa4114e4716733915ee3ad556c90d8356b5ee63d953d0a15cf8272346cef84a3274d1eae3ff8b3e6325645c23c7b66f4c197
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//:AEwVs+0jNDY1qi/qH

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral1/memory/108-17-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/108-36-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/108-63-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/108-67-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/108-72-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/108-79-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2348	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/108-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/108-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000016d0c-7.dat	upx
behavioral1/memory/2348-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/108-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/108-36-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000a000000016d3f-55.dat	upx
behavioral1/memory/108-63-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/108-67-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/108-72-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2348-75-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/108-79-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2348-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
File created	C:\Windows\java.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
File created	C:\Windows\services.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2348	108	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	29
PID 108 wrote to memory of 2348	108	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	29
PID 108 wrote to memory of 2348	108	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	29
PID 108 wrote to memory of 2348	108	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	29

C:\Users\Admin\AppData\Local\Temp\2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
"C:\Users\Admin\AppData\Local\Temp\2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bcepeU.log

Filesize
320B

MD5
8bd03a4584a99a47077a0431754df220

SHA1
b7e07117381f4bc03f67b34aa1b6c61b545d9086

SHA256
40dbe204c7ac1a9047e783997bf690395d6bdab0d543ef7f249e11fc061df06b

SHA512
c1d2638fb83cd7107d6f26a1368533eee7dd57467f8d1e2989b43c7ca83c19e1d58cf923541051570c47ed413f045e21c24db1046d933d0567f87de7f5ec9ff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2D3B.tmp

Filesize
29KB

MD5
39d2d307d94f7d6ddc5ed20d2588425d

SHA1
7d5e111b01d08617218ae7d5851b75eba898ccba

SHA256
d324cb2baa14b803ba4c40ab809de1a68d81383f4ff2df020d2bf312562be91a

SHA512
500fb6d1b833360e1c960ac6420011fcd04f1f3b870be81d19142cfb4e5a372028c3a198df09207d502b34ff47ce6b909503dfada3eab45a06715db9f6ed4d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
98462ed5bb8f69104b3d75a80598d26d

SHA1
76d33b7f892b2431b659d5398079b2a31f0cd01b

SHA256
81244fc238702d1502a3dea20d8d31b8904e449c5b8a439eb66557138753ee38

SHA512
7f22aa5db57cec542ffbe03dd4d1dc47bcdbf7a8e1582d63a0c758ba413a1e11014dcef495e457a7eb7fe887767c12abf37559ff3901d047d1934b921d51e6fd

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/108-36-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/108-79-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-72-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-67-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/108-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/108-63-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2348-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-75-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2348-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads