mydoom | 837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906

General

Target

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
Size

29KB
MD5

d647828de4c288db7f4550fd5b69eb80
SHA1

9017aaffd9e1ca325fdaec3051fe27be864d4e11
SHA256

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906
SHA512

2b35f96f09bce55e8036950a4de291dab870c68e7d17fea8fa153b6cebc18ffb1498033fb180156f9ee50e316f67124da1cf7bb02121b2fd0c1f92c4a88503ea
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/s:AEwVs+0jNDY1qi/qk

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4560-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-100-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-148-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-152-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-159-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4560-203-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2148 services.exe

pid	process
2148	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4560-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/2148-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2148-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2148-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2148-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2148-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp9E12.tmp	upx
behavioral2/memory/4560-100-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-101-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-148-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2148-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-159-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4560-203-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2148-209-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe

description	ioc	process
File created	C:\Windows\services.exe	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
File opened for modification	C:\Windows\java.exe	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
File created	C:\Windows\java.exe	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exeservices.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe

description	pid	process	target process
PID 4560 wrote to memory of 2148	4560	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe	services.exe
PID 4560 wrote to memory of 2148	4560	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe	services.exe
PID 4560 wrote to memory of 2148	4560	837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe
"C:\Users\Admin\AppData\Local\Temp\837463c45dae014c8530def473114a72aaca017ace1b8173d853823c885dd906N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAZ6MGFU\default[4].htm

Filesize
312B

MD5
5431b34b55fc2e8dfe8e2e977e26e6b5

SHA1
87cf8feeb854e523871271b6f5634576de3e7c40

SHA256
3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

SHA512
6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9E12.tmp

Filesize
29KB

MD5
39d63a9b8771f68fbaeb350b13d6769f

SHA1
eabb3ed1c58434347284b036fad8740a8badf29b

SHA256
1901cf12b8fac7e9b90dc47b5b02fc540e659f5128307d5003e835882cdedc73

SHA512
0a886f02ea2f369caba05ab9239fca75f64a4ab7948e4c5613a294a91cc762a05c7da6f2cf678fd0354cf443de67cadba38e2c8d11e7e0c15cebc03b65e2fdb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
fb4a35a033ab70fa07040a574f7e28ad

SHA1
59b07e896bbb1b10f4b1f440e7ea101c718897b8

SHA256
6fb39c1fb14a985619515be66c69bce788eaedfd102e996cabd9a4057c47fca5

SHA512
a9162c71743e38e511a68fe67a70c2dc88aa560f6a186874d308ef2f45e9e57c8e8c996eafae3c6a704de91c031bfb13ae43f5078154dfa6646aa7ef2c9e0801

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
28f230f4af97dc2b235253f9264b2e3f

SHA1
0480da3878cc02a34d7c59e0785deb99d7e47dbd

SHA256
2a17259e9593b12a8c3fa4236b2abbb9aee41e14c1c5308f05b2c5ecc17f31e0

SHA512
6680d412c5c633d93f3f0f2e85bf241c46eeb5cbd9b8e93f63e1eb7142d854a9bd16b70834cf3ec4eda83ad71668c902617b7d84beada683486c7c9464123670

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
44e7bf7288c1d383b7a2ea67c521e699

SHA1
c7a1526a8914863c565bae06e70823870b72c619

SHA256
a1b740f01f2a67606ea300158e32f24fa0cb76e167388d7b09af48745c799171

SHA512
c675ad1307c2d0125898ee461ebf94f4caebdd196c7391144b1952954f311fa0f5b9a4a5fee040d5b960f054cd3fead3a461e88b08253406bc899a5f430b2a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2148-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-209-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-101-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2148-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4560-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-148-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-159-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-100-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-203-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4560-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads