mydoom | b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
Size

41KB
MD5

0ec0db7565b6c9d7efb3809e08a099f0
SHA1

5715d34bc482163604e90f877fb4807f1ed9830c
SHA256

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7
SHA512

bed4ebe8a5e6683cf8f59adb250691ec54da015674276cdc0e211816c1730b648ba37cd8732cfe8bdc118b278bee0c9e02fcdab5ad09283ca3939c9185c52cb8
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2488-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-27-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-136-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-149-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-158-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-189-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2488-225-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid	Process
4908	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exeservices.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2488-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023bbc-4.dat	upx
behavioral2/memory/4908-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4908-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4908-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4908-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000a000000023c37-43.dat	upx
behavioral2/memory/2488-136-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4908-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-158-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-189-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-191-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2488-225-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4908-229-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe

description	ioc	Process
File created	C:\Windows\services.exe	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
File opened for modification	C:\Windows\java.exe	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
File created	C:\Windows\java.exe	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exeservices.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe

description	pid	Process	procid_target
PID 2488 wrote to memory of 4908	2488	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe	82
PID 2488 wrote to memory of 4908	2488	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe	82
PID 2488 wrote to memory of 4908	2488	b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe	82

C:\Users\Admin\AppData\Local\Temp\b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe
"C:\Users\Admin\AppData\Local\Temp\b6e304c3463d94c18bc38ad2cf6e237e7d2a20955a0af568900f0c79c2caa9f7N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\default[1].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0TSRVAPX\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAZ6MGFU\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\kcwaEvxwxU.log

Filesize
128B

MD5
dfbf15f96ce74607076dae2b90ba7617

SHA1
cb86fd5e272c0a3cb51eb94b195c549d657d2940

SHA256
fd6f315aac12f7cb859748647ac70d0dbf655abc886fca451bbda4ec6e0fa784

SHA512
e4cbf5a3ed9ec5e0391d63c7a689057611385e5528cd9ecfa775233632aa8853f15ef2a2ac4b58a70fae3e07dd638306bcef25710472a5178f7e2c518c73d269

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7A2E.tmp

Filesize
41KB

MD5
7cc6c00b8363c98b0efd8b5d42c048e0

SHA1
af948982886ae76d95bfd3bd24d20fde9ad9ee3f

SHA256
b2405e23a2e2bfea5d4581a196fcfbed7ff887857ba83b297d5004f38b0e0d72

SHA512
077244d8c2038fde9960211709245c7940fc392f339dd0edbe9405d6b3c27d3284de2093fe14983a853c456ea07b8c49c39bcbd4e0a36014d3328946bbb28601

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
8922b234011457a6f72c8636c3a26e49

SHA1
5859f7d5ccaeb65e37501f1f51e9bc453cefd627

SHA256
fc6289b0a13c2fbf824d009363d1517c91ab79fe1fd743c6335ba3d533de65a2

SHA512
78cb557efbc9fe8922a525b8f98bcbe0cfe36bf9bd71c995883d839850de54be2aad359564b1a8e5560b937d56484ff7167388e88cfeeb1ab7cd8c739aa8a602

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
e939f6c099688925c224009d6414a237

SHA1
38eb6bf9820f3ae31d7ef44af584ceb5e01c8f69

SHA256
665e95f08fae247b0785becd7805314e70f706a552f6d1994f7d180d71038e25

SHA512
398280954734e78c01ecb9f1b460813d09e909de5f162d7b5b1dfc1a37603fb2eab9e68f0dcaab192e614a5345bf976a2d3abf277a4e0ca54978302272452914

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
ac20c4020df2f700126a3987d3100448

SHA1
0235d3747e50621ff9f15585595454996a813c1a

SHA256
f65d63a6f486ea3de2012f575a7144e45a0e639f5e52688e79142031b1cc5aad

SHA512
9e25b9232e03921065ed6b362237942530e3b8cc3b884a7368d6043a78b22a2c5fe05ee5911d72c126ccd6645dd893c70bac9afe76b09b7cfcaaefc730807c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2488-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-158-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-189-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-136-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-225-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2488-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4908-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-191-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-229-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4908-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download