mydoom | c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373

General

Target

c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
Size

29KB
MD5

bfec993313e7dd2602ed901b34b9a967
SHA1

4b68ca3eb5c27f54399fd667747bda03dcccc883
SHA256

c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373
SHA512

ff778bbf31d5f304ac7b4c7560eb62aa1177c05758e585aa5e2b50d2fb90c9013ebba9d539aac3e78547515daea405d34c648c3d19dc7edd9208b4bc2c86e516
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/s:AEwVs+0jNDY1qi/qk

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/1728-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-27-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-133-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-148-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-157-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-190-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1728-225-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4932	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1728-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0007000000023c8d-3.dat	upx
behavioral2/memory/4932-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023ca1-43.dat	upx
behavioral2/memory/1728-133-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-134-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-148-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-157-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-190-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-191-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1728-225-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4932-232-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
File opened for modification	C:\Windows\java.exe	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
File created	C:\Windows\java.exe	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4932	1728	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe	83
PID 1728 wrote to memory of 4932	1728	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe	83
PID 1728 wrote to memory of 4932	1728	c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe	83

C:\Users\Admin\AppData\Local\Temp\c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe
"C:\Users\Admin\AppData\Local\Temp\c5a206c3b1b66e6b21aaca5bbd7478922e6352a741ecf7ff18820a4938d0d373.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9IEW0KLU\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L6PPXFHA\default[5].htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9CAA.tmp

Filesize
29KB

MD5
c088c83150788565213ccc7f6a29839f

SHA1
15a32b2d3585f030316ecd638dd428ea5374c306

SHA256
bd3d6dd7fd9969c77336792677f073be2102d639c95467f8749c31e8684eec60

SHA512
415473a2740ebc7900c53649ffe27ff8cdce6f4ae568e91530469ab7b628a92f24f2329d3c1dee1ef379cd2d271176475525293b374712efc477e610329403bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9E3A.tmp

Filesize
29KB

MD5
f9d94eaebee53f80881cd5fad9d35eec

SHA1
8b6d368c47846e7ed30a2c2ff299e9b51ebedec3

SHA256
a89c50c258600e66e86e4c8ac1b2f1083ec572c3163a3910a487fdc2d2aed55a

SHA512
3354f118fd618549d93cfa29072e6a1613dd01998d4446e275ad84a5f51cd12ba10cf50b4de75cab51f9e94bb6691a2b73b5c6320f1dc550b259c5b1adc77cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
e384b9e0ff95f5ff9edf072527ee0fa2

SHA1
68cf6afb04646d9c9a25bcdf899ea1245294e6f3

SHA256
42289de9ee28dea3ad3274e2c863c1c806f2ee740b13b4334de647f056c02322

SHA512
f6a91877f0175c83da095e79093831420e8951f18e401bca6823a1b8f2823525eecbbc18387d77a75923aeb01577c36f91352413a80485577c2008dbe3e01c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
9711717e7ddc6a951044d210caa67eb5

SHA1
1791fe9d358946786e51b12c0b40b2ade622b656

SHA256
52595f041e06b89af2c8e9d9c354968b3d2578ec3bead1186417abb72df63bda

SHA512
af5d4806228213d692c3f90f3953811b1c8b69b5b153690b707124af5c41c0d731fd7b26c782a1e8b95bb86000a7dfbbc6886f9883f72d82ba0c903ea185c41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
6233e821b3c2205d97cdfbfe5be3db86

SHA1
60dea2aa5174dfe78f252166e6604db1e0288b28

SHA256
92c409c98e3f764fdb367ad35275d373e064b77f788416bc0c5cd3f04d509b9e

SHA512
244d3c7b6e3a9cb9fbbb5f0e4d85a652bdf2082cb47e364492c47462b150a0962dbcd955d8a8042dcc6423dd9b5ac2786ad0a78957d4f3200e90513d0ce986a4

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1728-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-157-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-148-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-190-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-225-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1728-133-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-134-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-191-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-232-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads