mydoom | e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686

General

Target

e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
Size

29KB
MD5

ebb74b8d909a38de53445ed5b40edbf0
SHA1

7ad0598a44bc4d6f8912490bb2a4b8074ded287f
SHA256

e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686
SHA512

465a9c8e8f1d4f96ee4b9570bc3eae52447bc62fe4e1fb801db7c8f57588b394f62ae7f99deae469f4856177735329a8b2c00cce60ac8cb5cb1dba97ee13da9c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/X:AEwVs+0jNDY1qi/qv

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/1216-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-103-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-149-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-153-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-170-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1216-209-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2068	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1216-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023bbe-5.dat	upx
behavioral2/memory/2068-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2068-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2068-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2068-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2068-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023c20-38.dat	upx
behavioral2/memory/1216-103-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2068-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-153-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-170-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-172-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1216-209-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2068-213-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
File opened for modification	C:\Windows\java.exe	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
File created	C:\Windows\java.exe	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2068	1216	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe	83
PID 1216 wrote to memory of 2068	1216	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe	83
PID 1216 wrote to memory of 2068	1216	e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe	83

C:\Users\Admin\AppData\Local\Temp\e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe
"C:\Users\Admin\AppData\Local\Temp\e07736195b247c86de838eca3d9187b5c0f407a9e277053968d5c0270ddfc686N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OVS68NE\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L6PPXFHA\default[1].htm

Filesize
313B

MD5
ffb72ab4faba49ad441ce07db37dd8b6

SHA1
194e13c1c32ebb6e7a1dc912261cbd58a82ff71e

SHA256
7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660

SHA512
517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L6PPXFHA\default[2].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp88F2.tmp

Filesize
29KB

MD5
3d1517ade23ddfd2b5e5471a6b215010

SHA1
e259db409e623a8b2f0e2212ed809a8529906f99

SHA256
5eaa03932456b6ec127c7a51501b4529304de4e54c6fbe89e145675fedd1676d

SHA512
83467cabe48f791836fac3c0ac57f8661beb57c6c78be5b440d91075967743bc75a0f5afde0d9c73b3b83518a77e003e8095970021b989546a0c69bd0e9ec7ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
6c8ec478229f69f743709a8da5f5d5dd

SHA1
58ad4a3aae2fff0c0b5a6023bdedf466eae34b57

SHA256
378a5aff728ed62d4cfe0aedd6d95a81700cd24d9862f759fd08f9099f922184

SHA512
3ee46119830aa0f68e315c322c4bb3c38bd35173c36777fefff85109cd844f8fa0ce93351903ba0bd5a677f1c9f8b9ee838b7b0c41aa758ba6d7c5600c9f0539

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
06da87dd0c77b990a8fe56e45d96cfdf

SHA1
414cd0aa1b17c068de8d57c4ac740237faf4a19c

SHA256
17809c39dd008e9b84b4bf9f00bcd5ba2e6a4f2d7b2d25242a54c20c1eea8c58

SHA512
baaa5f8b907b86a5729d106a4007718186d3d101a3eb73bcae7f4e8948d04bd7d78f165822b341063737eb297c1fb55590cd165d3485a3e57dfb29258e4d8129

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
aec73a9864a84e687247ad66426fd0f5

SHA1
467435da73632d8daee46a19419960671c59a996

SHA256
92b381e94ce407fc89d9f12a4b94769751d5de4c652eda77b09528b578898dd0

SHA512
bf78f8bfc28ae09b4d7afd1d07391169f09e9791fbc077caa9dea0dfc1bd3ec011d489bc691db87fe679ab9553038505fe03b77438e71c61f6a70bc573f0f690

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1216-153-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-209-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-170-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-103-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1216-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2068-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-172-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-213-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2068-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads