mydoom | 3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f

General

Target

3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe
Size

41KB
MD5

32e85cc02997fefe743a15129241243e
SHA1

6c326de669078a81ff41f2d3e6b171aa61a3a39f
SHA256

3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f
SHA512

7112494e184115bd90e3398f54b921c6d9b3d02eadf7e6d3a9ac9d8da24a007370feba940122ed21031eb13ecdb2444535d6e8c7ec869641f0da00303493f741
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/4852-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4852-46-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4852-118-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4852-173-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4852-177-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4852-184-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3508	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0008000000023cbe-4.dat	upx
behavioral2/memory/4852-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4852-46-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000707-60.dat	upx
behavioral2/memory/4852-118-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-126-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4852-173-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-174-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4852-177-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-178-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-180-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4852-184-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-185-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe
File opened for modification	C:\Windows\java.exe	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe
File created	C:\Windows\java.exe	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3508	4852	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe	85
PID 4852 wrote to memory of 3508	4852	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe	85
PID 4852 wrote to memory of 3508	4852	3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe	85

C:\Users\Admin\AppData\Local\Temp\3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe
"C:\Users\Admin\AppData\Local\Temp\3a5c566461cf71cd12052ed9c0b6dcc6003310f3f2502e0a00a5ad573139186f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\rxkn9ioex.log

Filesize
128B

MD5
8b536733283bc0ec5346d75ee9c5caa7

SHA1
0081568f5c6acb05f6d3403e65684f81c950616b

SHA256
6176701c29a16de3dcbf7129e308f74ced56b378b97b075ac593a98db92f8743

SHA512
f246309708da6caee8f108b61168caa28713c1aaf9292b2c03c6847f3a6c6735fb11d51f39a0c3cd0aee9dd0437219dcd8a760ceae509b995731cadf1a538c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4FA.tmp

Filesize
41KB

MD5
bc561dfbbe0e47d2b5f1d31ce8023f5d

SHA1
e921264a6f64662eef54cedc424205fab14a687b

SHA256
62991b1f4987d7923143b93b5bd2610d9f29d7fd79db78f44e6ddab0e9761558

SHA512
e969dd5c539bfd97486e42643df0b69430754ded4b2bd37ea62d355cf0e440be4a9c2cbbb7af204320aa8b801e0f18f174a314ab10edad227910bc6c61d208cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
1e9865788f5e36a601a94dcdb1d4aeff

SHA1
be5eb45a83725c329b45105c7445929d718c40b4

SHA256
c291bffaf09d80e018a61df1246ffaae38f41ffd9bdd2bd0803df59c8bd610b3

SHA512
a5e4cb6d99f9e771f23ecdd373a314e4680c7e0ce323e5625066788002c6a03d4f7e07795b9489ad8d548c4cdfb103891810059690743b758fbad00fa9ef7a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
68143cc962e0e0bda8911971f649ae16

SHA1
5fd88f4d94ed4a31c357632240a8bfafccc6ae03

SHA256
5d8a0eaa442ac24a4374befeb4906772f35a9e209966e1e9d7615ca419fac735

SHA512
80a0893a51aeeaa070096547b59f40414776abb8c5ad201d1e33f7a34bb86601e3df233b4ff244fcd36106a84ec5d19fb9311ff37356f0f810f334f818b2436b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
9d5a237a9a9fedef9fb11af3ff8c09b7

SHA1
f2a56585ede9d2aaeafbba949f78fd7680dd4ee6

SHA256
41f302a1e3a6ab8fe90e1fef043a7c47cad8f3f67101329d31cec51ff0256c64

SHA512
1a78e77e3b00feb5b5a5a97a5e3f1213f44f1958937017bffdd0d7ca0cf644cbcd35d76fd59a89688a6a5f83d1ce85634d0607888651012fb72446a0d28f6e90

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3508-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-174-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-185-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-126-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-180-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4852-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-177-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-173-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-184-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-118-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4852-46-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads