mydoom | 5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
Size

29KB
MD5

f3a7493a18b541d51e587c207da05932
SHA1

147fe8e7435005de8aec024a0547017e00398c78
SHA256

5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842
SHA512

2302ea8143aeb2f9553d964b7db235e1f0cf53e6cf9950cae4b10b464d9826d237693f6920b2c6cd6a9c4664de46cd6699761adf0073f34d00d4e40226492cfd
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/U:AEwVs+0jNDY1qi/qs

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/2376-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-186-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-203-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-213-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-243-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2376-292-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4912	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2376-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0008000000023c93-4.dat	upx
behavioral2/memory/2376-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000021ea9-55.dat	upx
behavioral2/memory/2376-186-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-187-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-203-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-204-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4912-209-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-213-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-214-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-243-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-244-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2376-292-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4912-293-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
File opened for modification	C:\Windows\java.exe	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
File created	C:\Windows\java.exe	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4912	2376	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe	83
PID 2376 wrote to memory of 4912	2376	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe	83
PID 2376 wrote to memory of 4912	2376	5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe	83

C:\Users\Admin\AppData\Local\Temp\5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe
"C:\Users\Admin\AppData\Local\Temp\5d4370c031ec69c63e9ca55c0463c942308b602a7c8cb3fa3c7e3acaff86b842.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\LF0OPE9J.htm

Filesize
153KB

MD5
5d4ab7682b548049d95876558c57f72c

SHA1
e6fc2686c51a2754cf793ba8fcca07ef3df17bbb

SHA256
0f87a38d920e699579a4a58cf4299ae77ebcc2fdefbf0431e0edd12dcd0bc6d8

SHA512
7d91e7a3925e85b9b522b7f972b84d8a2f83ceaeb08ef2bfeebab5dfdd8e2a3149a61a6f681835b9041f7cfee635364f280d03bb22eee9ede6ac68325cc6d137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\search[2].htm

Filesize
200KB

MD5
fe0ba124ed1b80c2de9efa6106f419d5

SHA1
a6e64a2514a3e080366bdb358a11748ae1044490

SHA256
97cef4d0ebc2dc231315905f8bb842a338d14af49d39d508d40434a2a34b5aad

SHA512
97192d93099189b298e46cd0990c1d908cbb209be88dbbd2ae54da95847008f235fa6536c3af7627d44cc9517e6702c9caa41ae33e3207643794fe9cc04f2f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\search[4].htm

Filesize
121KB

MD5
a9db96a2cf7c413e1c5f5029c492827e

SHA1
9648a33606a327bec818327566f5b76bb05851f2

SHA256
e0eb664718760c8da452e20bf0084e11faff1f32580b16f773ea24879c8091a3

SHA512
6c030fbd98139c7ae4bd696aee62c0497c342fa8be2acc62fb3169474ee5617927ed3aa637d77087fa59aa82ffd642c7ba9daf37dfbcc7b79429e523cc536913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\default[3].htm

Filesize
312B

MD5
5431b34b55fc2e8dfe8e2e977e26e6b5

SHA1
87cf8feeb854e523871271b6f5634576de3e7c40

SHA256
3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

SHA512
6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\search[3].htm

Filesize
170KB

MD5
9a751149aea1df8fda73ab51e7c1098f

SHA1
dd74702cf3bfde349380d851ebbb024087534339

SHA256
777692bbdc9b87361c52e61a845315a77954baeb1fcf249ca39e4edca1a6ccec

SHA512
d33f199e5c3354d2c6505d8ae19653d4c848625a52fd0b92a47939e197997c03fa7f0d8b2fbe63da62de01a538f7315f5dd196b789969076a1ddb11d7b644dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\search[4].htm

Filesize
116KB

MD5
84fdab4483fc4e8321a4422a5b85c815

SHA1
194392dc0c41b2d8f7985ce51eb462e02083bd96

SHA256
84ed2d345e3a2cd74de1d7871de71b38857a6de2636f6c44f19463b35eed9dbd

SHA512
2654481de99fe5b40bf9b7b084939af9d7ed7f96f150db79aeaac5b764148a370a3544d93bc279fe0361ddaee17b0e3b3adf22265082ea342803eb60d6750b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q8uxo.log

Filesize
320B

MD5
0472e8a8bd58eae941bf1b142ecc475c

SHA1
25b32fb0971a0cb828a1c752f6b03d405b368bfc

SHA256
695d101697f9a83f93311f2b15ada48eb50aa5a867bbea37839c57995e2a303f

SHA512
0bbf518cfd7877bebe32b4e0132e90d3dfbb8cdd5bdf39f49bf1acd90ac7d16a5602edf40260c62bf7c7f2ebe840e39861ea168c66bcd6721b6a1ce6d01b8013

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF28B.tmp

Filesize
29KB

MD5
a8aa83c331dec04e584838b9a7ffd11f

SHA1
d4a640a2ad0c84e076ef0b78d12d213fd0fb0ce5

SHA256
f83c31aa4e4d45e9a4aa1928dfad4a41f98d6724f1f307bbb10d5ab161052d4b

SHA512
eb4b6329110c1100e9b1665e84fbbdffc1002f8f106eca88303e87ecc1b24d199686b48b7081a3c6b313e0aca46d8db663e6b0daec2d8fe801f53147cfdd4b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF46A.tmp

Filesize
29KB

MD5
3b242ac5124755cca086d5cfdff07d6e

SHA1
dddb1b3ca8074a542d886160afe5e34bcb75bb5a

SHA256
56fe093a5e514fcb815e9f122fa70227fb48596b311b2d311611ec4f25fa066c

SHA512
060d78cf356846f5bef1fcf09c9bd33274421143506724f5cabee25688ed85a0e2524cfd887d5eb46135b6e21a53928ce4312a683b6989878136527a397981b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
e1342b165cbdbf310c0fc3e794affdc1

SHA1
a69fb1e86016287e476433057b66401734809330

SHA256
7ce0eb9e3227f612cdda1b6dc81fbf4167387f78eab65d2f29429345de6277d2

SHA512
0b189d7c20bee70ee73eb47e009b86ec39a35363b9a3d533f02d437e417265585d80301b2927b61d927d24fbe86e1adb8382ba880efdb9d2c0d45ff2443f6c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
803150acb46bd7cfbcdd6664d24a125b

SHA1
4977001cca1341e21fc4cb486e26e75734fd36f1

SHA256
e98f7a3926b364891f3878bcdd64ad9acdd543407f05c8bca6ee70def0c8ec7f

SHA512
2a6e3d29fc86c035536d98bf66c30f10be48cd9455fc4c03e5da9b4e64789102a5938a0292a83458f6d777895d12a5443b168061c36549e12b510176fb94e804

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2376-213-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-186-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-292-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-243-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-203-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4912-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-214-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-187-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-204-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-209-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-244-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-293-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4912-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads