mydoom | f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938c

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
Size

29KB
MD5

a640015cb23ad329495e2fffcb1d67a0
SHA1

f32c662bbbb1f8223e8249d58c18495734179824
SHA256

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938c
SHA512

f4d1a0bd217703a6d30c3d4170c4d71362eaa673b273fd9700e66d563c2bdd54bf3e2898c418cdcc114142c6578d82672ebf5391dd91b9c4ed61a62a3c4a6ee0
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Y:AEwVs+0jNDY1qi/qg

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3904-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3904-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3904-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3904-166-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3904-179-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3904-186-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1720 services.exe

pid	process
1720	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3904-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/1720-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpA15E.tmp	upx
behavioral2/memory/3904-166-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-167-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-179-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-180-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1720-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-186-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1720-187-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe

description	ioc	process
File created	C:\Windows\java.exe	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
File created	C:\Windows\services.exe	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
File opened for modification	C:\Windows\java.exe	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exeservices.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe

description	pid	process	target process
PID 3904 wrote to memory of 1720	3904	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe	services.exe
PID 3904 wrote to memory of 1720	3904	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe	services.exe
PID 3904 wrote to memory of 1720	3904	f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe
"C:\Users\Admin\AppData\Local\Temp\f157c773e8bfc43ae44ce9cc78582d016a4d6b8cb1faba850c33667de53d938cN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\I486A2K1.htm

Filesize
153KB

MD5
6c6eba6df667e1e4d8efa2b4491b29ed

SHA1
037cdc1617cc48f689254c7bd6918a832b8baa0e

SHA256
9ae70ecad8659e715d87a40f863d5e1f7a88cc10e33a1d370e9388227432bae8

SHA512
94892cd5c46a4436260d0c815c98e7a4f87db6b284aaed9e23ff967ad213933c6550d835dca3aead6a7fb21f8670061a8ca1a333c2f7257881b99620f664d94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\search[2].htm

Filesize
150KB

MD5
80fd59b92c1ea955f48029561be0fd95

SHA1
544ec51bac1f8bf102629fa8f60abbcebd9486f2

SHA256
35a9f7725a6b3d1828aa399d1df9dcbd2f07fe3cdf79cbeb8ff40b5cb5a02166

SHA512
c981219e0f1b6e2b0b6a738bf41199ff4fba74b4b86b71c81760ecdb50425c370db056adf72615b10ce82a080f1cd39f45059aeb8d10634540591b93c43760e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA15E.tmp

Filesize
29KB

MD5
6fa4efd405fc38cd0819f50d668b4e50

SHA1
58d6556b7693189b0de97f7e24545ce1380b1a0a

SHA256
45b95a4105fc8352988b5dd82a9b0506507c2ff3f4481f8beda5b43a0aa30738

SHA512
3473c073e2499328d8780499d6ef5d0f921c5dbaee571d1607a1702119ea182f091a20559baece1bc6e3a0f5f5c6de9d982d5d99b75f4b2b385be0ea7f9905c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA1BF.tmp

Filesize
29KB

MD5
829c37aaa23e131f356773ba049a2c4e

SHA1
107d5d55326f7f90e20f5d8813fc8c46c5f01fa3

SHA256
e3da71749c138db926e7457af32e270030096b64d09dbb14ece215cea8211201

SHA512
05e5ed098847b8d18f8e81c9fa7cc0f8a0151709661cb0f9dd60f0a7c8f18e7c56f6e70b93affb2b155c7972d4a8324530e5adc4cc26471c83271c1d63f4fd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
5bfa6e2af4a2574e77676a0866ebb08a

SHA1
78254864ba338d82e5ac69a83b3a6fe1b8bce368

SHA256
de9b8fdcf2d070d9f26e31cf378f825ea50d541a7f08385ce88a98321fea7675

SHA512
def096d449d6bfb2668b7f12f652f40528fb175d1369443759c8b49853beb9ae97da1231c25cec8c67f1e0999ded8d1b7e48373414877b6209420c357791e41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
7c633b5752550ab16f4cc627a4801d7e

SHA1
1e64c4cdda14b1cee40b702a7a2b4897f21fb4f2

SHA256
ae81be2fb984d9935dbb629d0803c33520ca9e2a1dc6fefc9625fe4a0097513f

SHA512
e5c6c190e5095483bcbfdbdc4ae5e41c0a4a4f44d46b54631c3027f08fdfe3dfe02704875d680eeea059a03e487582cb00e2536c39b92e6c4ea6d3d1ca71ece6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
288B

MD5
1298f75f7dbf49bccddf08b13bae7602

SHA1
19670733afdfe80e1cd0fd1f8d184e90194b94eb

SHA256
8f8e53f853a18d5c9ae668dc9406464b36166fe0170403f33f30e8f136ee9b29

SHA512
51e181a21df6bec82378c86b567ada499fe4a5f3634533b3f3a03d26f63f3ad1d874abe8108fa124f8f0f68d14efe58f65d748ea967f449b0b006d5db828bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1720-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-187-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-180-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-167-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-166-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-179-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-186-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download