mydoom | 635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6

General

Target

635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
Size

29KB
MD5

b8e82a6becfd1a191283e53c7cd31179
SHA1

3486999c8ca580184c94a9c04b02002510a9a471
SHA256

635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6
SHA512

ef66b19ea738d04cd14702e0020fac8f30546f53dff8262f1d28fa388c6022f01beb7e94352c1c20f3ca57eeeb02eea0927802b439abc62833ce9e6b01159f95
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Pw:AEwVs+0jNDY1qi/qg

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-60-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-143-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-159-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-166-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1732	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1976-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000023b8c-4.dat	upx
behavioral2/memory/1732-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1732-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1732-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0004000000000705-61.dat	upx
behavioral2/memory/1732-98-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-143-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1732-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-159-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1732-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1732-162-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-166-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1732-167-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
File created	C:\Windows\java.exe	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
File created	C:\Windows\services.exe	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1732	1976	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe	83
PID 1976 wrote to memory of 1732	1976	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe	83
PID 1976 wrote to memory of 1732	1976	635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe	83

C:\Users\Admin\AppData\Local\Temp\635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe
"C:\Users\Admin\AppData\Local\Temp\635ab61e60f4d56e50be23348c0676375297e292fd386db4674114d758b44ef6.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OVS68NE\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\plqrk.log

Filesize
320B

MD5
ad78d9497954960705bbe507d9503ef9

SHA1
587460559757e87dcbfb0705c1334d8d071cdf83

SHA256
2d57512591e25f782332ba08a30be5990af5a72b0a052e8455d1837f59a5df05

SHA512
a9caac3cf5724948b90eea2aedb308b899c3a3e13c4c665f33e556e67e481ed0a4bf57123dd49eb2955e431a888569763cfcdd8cb27a0a3f6450c20194488692

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15A3.tmp

Filesize
29KB

MD5
2c084eeb883d2e85ec584b03ba879097

SHA1
4e8616f923416849a67d4c3ddc7eac2db461d353

SHA256
c3870ec1177b64ebfc0dce7c427d711bf70ba2ce0a8ab100c90df41d1b2e862e

SHA512
aa6c61595f20147886e762d2906e19889e81bbc40577a46a8e50fc5478804c300ba2af8968c4164b2a36ffb87b6d866f461c31c5f135e43d988bfdda0463a2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
0cc0aea500bc0198de05f4b0ad3181fc

SHA1
b8ef8befe047c7aa3a4505a6092f6494e2a3fd94

SHA256
343a68b642bbca587e14df0e707919f917989d1b66f2f1909a50854026fa7fe8

SHA512
825cc16a635809823a63e65880a71abd0f83e4d3691dbcb6ea6465657da9720ba70f9591181cba78a81ff2595b91c744ff3cf2c488570da088595fdd67be2ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
6be3628083d532765045cb9b6717e80c

SHA1
e53c5ed36949680a6e3c800b4ebe35cf7e93f00f

SHA256
753fc1cb0d423e06dee832b3bc63e91318c411525f1f8281f88d18b5cc084fe2

SHA512
72d2c30d8ef9ff5d4df045e68ef96224c4d8c88452833c8c0e9b1ff65146f0df01d8d2ceab150218b797acf8b94dc175cae7858956b4abb61d8c7307c09ae97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
3b016a58545aaf75b74afff107e82343

SHA1
ae68bc9a68fd79479d9595fe547df6a58069f780

SHA256
3b53ef64fe64ffb0ff25a68be1d9bc878a205eddc676858b5d059a31d711f314

SHA512
03d1ce422d2a2250907ecdd5bb5cc3653407ffb863101f45ba51716a30f65726f6de8bc6f8e798a3c04c5aaf02b1296934f6ba8cc4bc17cf7ec6146b587442e3

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1732-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-167-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-98-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-162-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1732-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1976-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-159-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-143-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-166-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads