mydoom | 9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805

General

Target

9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
Size

41KB
MD5

be3341e79b2f12499de7c15ca4ec94a7
SHA1

f776f7211c191ea6e0a94f01a41009bf4e62506c
SHA256

9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805
SHA512

68bfd6a214dc0a52cbf422c59652992190046d1db5c1f79462fae12b9b72e96dbbb63f69953a0c3ed290e15426f1447ccf2d5e1dac72b9a2b749a142b9de837a
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/M:AEwVs+0jNDY1qi/qE

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1744-17-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1744-61-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1744-88-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1744-92-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2612 services.exe

pid	process
2612	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1744-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral1/memory/2612-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2612-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-61-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2612-62-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpD166.tmp	upx
behavioral1/memory/1744-88-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2612-89-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-92-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2612-93-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe

description	ioc	process
File created	C:\Windows\services.exe	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
File opened for modification	C:\Windows\java.exe	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
File created	C:\Windows\java.exe	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

services.exe9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe

description	pid	process	target process
PID 1744 wrote to memory of 2612	1744	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe	services.exe
PID 1744 wrote to memory of 2612	1744	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe	services.exe
PID 1744 wrote to memory of 2612	1744	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe	services.exe
PID 1744 wrote to memory of 2612	1744	9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe
"C:\Users\Admin\AppData\Local\Temp\9b81cd810d0d5df83421566be57d8c43d50fab258c94339200e70a82f8806805.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD166.tmp

Filesize
41KB

MD5
44d1446bc00ee6c796428d0cc3ebe5ab

SHA1
bbc9293a50babd795084dd0126bbc36e95a0cf14

SHA256
1db01e04df22fc2497e05e1d5151c489de17de857c168e234f5b4d9c50b4d94f

SHA512
ec565ee222ae7b5b5e49f7d83767456d1a72c7995d8aed6313e2e8ccc8588fa16f96544acf92eb3690334b08c9a1253ed562004ac39fc4cd27d8009e3fd5459e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yrwaaf.log

Filesize
128B

MD5
c8546969b67854736c68232b1fc05e22

SHA1
1914190762909a35ccc56bd3c6fb3d3ce65899c4

SHA256
1a39607c151497f354c4ee95c12300fa4330a7c73ea534642fea70d4a060a176

SHA512
a2f4bbccdc9c7e447a597a74c3dab3e1307faf93b648f7c548551a829c51fa38f3766b22eaba267ea25dc805f826ba8ea9795d6600e933bdb9de57d67b5507a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
12KB

MD5
673e930a1126cfa1265401412893112e

SHA1
33f9128c7c8414a6537c145276f678378ec0791e

SHA256
937b2e01eff69a4ebff275bd0e2bc643bef571612364e1e5bd7bbefd0b62d446

SHA512
34e32ccf0b933af37dd6003e1cd1adc329bf5175f31a89e46936c462be033b032016cc393d02978c7264fd90701f7373cf2078573d01fe3ccbf86a41e4bd396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
a591fa2ba73b38369a3687cce646a9ab

SHA1
584b7e53572a077de872a7d5efae22176117fa70

SHA256
097334e55601b4dd74cef642369de55de84ff93b6e838baacd9dce2334591c47

SHA512
ac3a5b022a26d23e6a69e7ae4d215b4e6a36a2dfe463000e15667e004bfd4a3756835a707db5ea2cce0ed77e243ead4eb7b42c4c5130bda487ed878a13ee2d1b

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1744-92-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1744-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1744-18-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1744-88-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1744-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1744-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1744-61-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1744-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2612-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-89-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-93-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads