mydoom | 2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411

General

Target

2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
Size

29KB
MD5

352302baa5a38e526da7e7211b86e68e
SHA1

1bb2f81facf650bb757a46212b1558cfad9b702d
SHA256

2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411
SHA512

81fda557fd029ad954083ed32e0aaa4114e4716733915ee3ad556c90d8356b5ee63d953d0a15cf8272346cef84a3274d1eae3ff8b3e6325645c23c7b66f4c197
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//:AEwVs+0jNDY1qi/qH

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 2 IoCs

resource	yara_rule
behavioral2/memory/3512-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3512-56-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2784	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3512-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023c82-6.dat	upx
behavioral2/memory/2784-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3512-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2784-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2784-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3512-56-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2784-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000000705-62.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
File opened for modification	C:\Windows\java.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
File created	C:\Windows\java.exe	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2784	3512	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	82
PID 3512 wrote to memory of 2784	3512	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	82
PID 3512 wrote to memory of 2784	3512	2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe	82

C:\Users\Admin\AppData\Local\Temp\2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe
"C:\Users\Admin\AppData\Local\Temp\2da0b291aee31fddce48e96380e559a4caf32ad4e4cb97a4a9fc249d0ca75411.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7C1C.tmp

Filesize
29KB

MD5
1ff6ab7e17f51c53469e23adfcc3d42c

SHA1
b92b7f9f956a3b0af86b29af2744cfa9d29349c3

SHA256
ad80e29b7580cf6bebef75af3256cbf7a27e0e766e74f622164fb0c6e790ec8d

SHA512
4230b2065f32fcdfb591227ce07850cca8e0ee243db9743f1d497af9578ad8d162bd9df692fae364927cc2e058e84540710b2c5820100c6c8eeafd95f3253780

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7DEC.tmp

Filesize
29KB

MD5
5e33fca8a065803b58cf6b49ea80b7bd

SHA1
382974774dd71003385d5489cf4661ae40bc6c5c

SHA256
53db3caf7949dbbd606ddf7c68cf95ee4bc4046f0d250f4c7d2607b42f3e4163

SHA512
c03566793dcb3729bb5ea735612217c5c5a4041124b24cd775d7b867146cf64a738f9ffc32a84fda1c48886afb6ba7af439aa06595b9882c6e7de1d2a5bd296b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xs0fkpfakf.log

Filesize
320B

MD5
0186553124c8ab8738c21324b91b4339

SHA1
40b79126be2a4e545e4b7cb1a7e95417af1393d3

SHA256
0dd98c908958fd1a568109cab620194bda71268fda8b3699ba38e6f4e7bbf7cf

SHA512
5ccfb6257f57ca0fd808e465494ebef359053639a60a9766f859a5d08f3e753a23c5114b1dafc37d1ecb5d214551ccfff3e777518877944216c1887c9909bb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
d380af9a775c41af4643381f224b37ba

SHA1
c759094c06ae53a93c5a674f15e0e4dec75e5d2a

SHA256
cb7a3298d4a9358dc4f74b07a57c76b12325cf43e062b56188498178f9f6feca

SHA512
950031feff4b2665b4165d824b06d5356800e67df4593c4fd6fe0c1ceaa948ea8283748df5653f979ca39dbb36c25440540f190018fadfe1d5934d2ddc7c2db4

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2784-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2784-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3512-56-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3512-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3512-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads