mydoom | 4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe
Size

29KB
MD5

4fd6eb3f710e9009d91bfc664d5137cd
SHA1

b7a6485e0018f78a56353ce2076b969ba2d091db
SHA256

4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33
SHA512

5403248c7ff15fcc0e80c6ba5d9c57cd562d61e6d05aaf7148aac04400bed30961c2c3090aa821e0683c7c95efb2119c8e3306cda0d2193fec07d81c26713882
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Hu:AEwVs+0jNDY1qi/qm

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/456-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-193-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-226-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-233-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-265-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-306-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/456-353-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

3912 services.exe

pid	process
3912	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/456-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/3912-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpCCE2.tmp	upx
behavioral2/memory/456-193-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-194-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-226-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-227-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3912-229-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-233-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-234-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-265-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-266-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-306-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-307-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-353-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3912-354-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe

description	ioc	process
File created	C:\Windows\services.exe	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe
File opened for modification	C:\Windows\java.exe	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe
File created	C:\Windows\java.exe	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

services.exe4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe

description	pid	process	target process
PID 456 wrote to memory of 3912	456	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe	services.exe
PID 456 wrote to memory of 3912	456	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe	services.exe
PID 456 wrote to memory of 3912	456	4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe
"C:\Users\Admin\AppData\Local\Temp\4efe5e8d2a0d000eaa3881a8aa30c00533c7fd9ee1e14eade9c6956a5687cd33.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\KKS1OKWZ.htm

Filesize
153KB

MD5
cf49f95c9f87c398a07d185b9278dcfb

SHA1
a622f7c94bf18466a6242466f1de934efde87126

SHA256
0bd7a5be7e432b7054ae40f39be739d6eb6a1aa13d528fd6b9f703a8df5bb1c6

SHA512
60c7fdbaea7b720d7e5e65898b12db5791ac3c7eb9e4e700529eecb0a6257ce840faaf97672e039d1e3b1d96aed810bb867ce5b21247eb4423ef2f18240dab1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\default[3].htm

Filesize
313B

MD5
69c60ed308101b5335bf8f3965de4cee

SHA1
46fa4e015d3074e5278f30246dfc7e52395ee164

SHA256
1b949aeab999aed6ebea087159db61393d411edcbbf228b98f4b5c3d8711ad29

SHA512
4b3b388f53a35a0f1eb44706723d2814f010095a8629d692e8d6542ac4520e1f7caaa7a6bd79a7a00ed97bbd246fc8d74f51853432e386685d6771203a7d8ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\default[7].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\search[2].htm

Filesize
167KB

MD5
b5407699cb51d786d82af5111b2b074a

SHA1
983a291447c1d8fb09c12cc5b8712e3d0149fb08

SHA256
de60973f8fd89c36e75dd7f7fe1bf96d6867a8d687f40034b74c737e0bc4acba

SHA512
efd52ff21a4d1993b9fc76555c3611f7c1c1d1340bcaa576850ba7be991ec0f0e46dec4c3c477bf1412525a7105341f74463bcd5a50138245866f06381fe8ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W9QJOIKH\default[4].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ciwwh.log

Filesize
320B

MD5
5a4b4f8bd8e3ae153569352ac5cce5b8

SHA1
fa9d937f5932ead3096b08423d3c3ad269302af8

SHA256
657670f67793d54348571a108881e5b8c3ce71505df2e268fd0a09cf18f88342

SHA512
81a60c4cc0a542565cc12c55963fafe10b4d60dd8d02862f70de0477d23202d252daec2897d7736d3260d0a79d711efb53a1519150a07c0074a976690c4ab364

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCCE2.tmp

Filesize
29KB

MD5
4a4473d71586a701ec005ff4ac3bd524

SHA1
e5fbf8456b002a1e1383ca07fc74279fc79b8aac

SHA256
8b1a98915c69e23122675312003cbc2b80cbeb0516573e5696e7bed827980ab7

SHA512
ec0da3de46ba39809bbbff8966c07b6e80eafdebdbd016c49f2217d9a26588cf3f9e100270a922015345f422154bff071ea1dc3d7c0241de6d3751b293ec84bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
9c338cf7315fb2769cce83ca04bafe89

SHA1
00936037d5aca306cfb8c725e62ab2673cbc1111

SHA256
ce34b5b33a6b23a720a40b999d7263732ac3b87be2d202b676883893b80870f9

SHA512
2a7a793adb712f216510ffc2d96ee2e41a4d13df14154da7f1b2eec6bfa74f4647d64699844d5b0b7c61072ef79d919af0f8efb6364da2bd49ecfd5a68db02a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
9a1770803632137d7606b7a7543fa778

SHA1
bf8a03c8aad57a69f940c8c6b4407b5ec49ca76d

SHA256
be9faadaffb2497bbe11f216feb2e192d9442cb033fe0410b2269d89e219180d

SHA512
930b4b17246e7374505e4a32bce5647b203de64952f6c12fa7edf578ab91ae091b58a20089605b6cd74eb99fd90e5a00cf8fcf78a2c0087343350672a944286e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
41eceec91690d1e3a51ec141c86c38c5

SHA1
cf8b582773f8b46b960aa792d7070ddeacc4a33d

SHA256
749c73524a0e8f6502febb74eedf67b28309a868a93319086b4b6e72f6e5460e

SHA512
d8f1b291fb1ecd07c976c970cf9dbb6214553027979062885afcd4e5792af489a57d202be1e6a007b4865f2fbf079982aa9c90613b224783a5190cd24985febe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/456-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-265-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-226-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-306-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-353-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-193-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/456-233-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3912-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-227-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-229-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-194-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-234-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-266-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-307-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-354-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3912-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download