mydoom | 725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1b

General

Target

725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe
Size

29KB
MD5

6ce8b5db50adcdf7b8e02c3934fa2fb0
SHA1

1ad06ad45e573d56011be26f2f84a19d58e35024
SHA256

725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1b
SHA512

669dfcee8ac545400d2fac5961001740ceb94c13cb7d4f47529e7529b45965af4960c24a8ac9d1fa52565aacf197673af2f5e95bd68ffb4ad69e9fc8e5ff3491
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/l3t:AEwVs+0jNDY1qi/qb

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1708-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1708-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1708-135-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1708-161-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1708-167-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1708-190-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

748 services.exe

pid	process
748	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

services.exe725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1708-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/748-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1708-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1708-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpCB6B.tmp	upx
behavioral2/memory/1708-135-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1708-161-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-162-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/748-166-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1708-167-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-168-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1708-190-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/748-193-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe

description	ioc	process
File created	C:\Windows\services.exe	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe
File opened for modification	C:\Windows\java.exe	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe
File created	C:\Windows\java.exe	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exeservices.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe

description	pid	process	target process
PID 1708 wrote to memory of 748	1708	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe	services.exe
PID 1708 wrote to memory of 748	1708	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe	services.exe
PID 1708 wrote to memory of 748	1708	725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe
"C:\Users\Admin\AppData\Local\Temp\725fd08ca17a360141fb6653d93a9d20be483e9c3b273dc67dd56fc0bebd9e1bN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB6B.tmp

Filesize
29KB

MD5
b7e2b89812e4130c6638f12bde201412

SHA1
53770bf46970282f2181b4622542b63874015d6e

SHA256
6c870588d9757499e434485bd29424cd3a1c12c7d8ad39e1af05c8453421eb51

SHA512
91be5ab5d90e61d434a62a266f05fdb44d74e25922b88620985399158442bd48c5384633439aff1483e7b0ccd51b7d4168cb05ca551e4fd194149e8bb0186194

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
d4b7a8edb973ebc88532dcf4124a82c0

SHA1
29aa2118a9cdc613bf9857e8d0e5367bf37f0ec0

SHA256
7861fe7fb6e37b60552c62329162b11a8ccb7f115a35f47497f9e0bbe81c87d3

SHA512
233778aaaa6fce7218d64d2bfc0f2ebfdd31b634e7e9bf0e5e70e37ca76e1bbe2ed2e61f8797b346195aa7eb3bfd2115444c663f13b3f2a09e3104b9f154190c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
8889ab5de92a047515d7bfdd3dd6bc99

SHA1
3c6fd3dbf914d3b3b6d8f6f4f16d090105729b18

SHA256
41f02a2fb33b04c2bf0c9075dbd00f80d3b03ff1f7a438ccb0c1be781afd1765

SHA512
fcd9564a1a5a5417d1d4bd3a743ae31b9c2ab6ebdb59693748aea4da49d9db6777192c69d9f738a79855b034568df38985dda80038745d12bcecd178f111adb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
7d5094bdadf279462f4ec964e77e4d8b

SHA1
65598bafbc446e4a99ec77da0e4ac1d7a08b55ae

SHA256
e2f67aa2c160b76357df3aa8a2bd2518f3ae1fb3f57aec3ecc992adbd39bc609

SHA512
907372efe4d5c17b107d954ab75ce5d4ac76ab4c370cde1a2dc639b3553f9d0b688d25f6e8c4df32993a050883bd3870c32e201c322e51b581efc5caa4f2917b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/748-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-162-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-193-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-168-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-166-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/748-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1708-161-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-167-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-135-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-190-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1708-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads