mydoom | 67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16

General

Target

67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe
Size

41KB
MD5

98365414006354fd8ea777dbd442b40d
SHA1

0f45700715bcc174b146376b13d8a95aa7817e68
SHA256

67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16
SHA512

8749931a85ba41d92aa0ddf767bac3d3d1790750e9c709e11bbf8fdcd4ec37f0731cd22563f475f0bed350aeb7645f379c26f1bf6dd49e0d0d5e461919cb36f0
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/O:AEwVs+0jNDY1qi/qm

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral1/memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2120-65-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2120-84-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2120-88-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2536	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2120-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-9-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000016c4e-10.dat	upx
behavioral1/memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2536-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2536-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2536-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-65-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-76.dat	upx
behavioral1/memory/2536-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-84-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2536-89-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-88-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe
File opened for modification	C:\Windows\java.exe	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe
File created	C:\Windows\java.exe	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2536	2120	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe	31
PID 2120 wrote to memory of 2536	2120	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe	31
PID 2120 wrote to memory of 2536	2120	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe	31
PID 2120 wrote to memory of 2536	2120	67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe	31

C:\Users\Admin\AppData\Local\Temp\67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe
"C:\Users\Admin\AppData\Local\Temp\67c384ea50f832ba5ef90ecfb749469f6a4f9d6991edd973eebbaef83c8d5b16.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA92D.tmp

Filesize
41KB

MD5
8cc4c5f93b4707a0a6b80338cdecac38

SHA1
9ba9946d247b953741d55028e049f3df28705577

SHA256
8bf860df68e32bea11d61a52cc28de2c62607fcb487bc94e1926b825e1b854b1

SHA512
0eb6bfb04c6d811438ba27de3b01f9a01f30458de566781eeccad3575b9cb530eedc39e009620f277b278ef9c99c764ec4a6ea6c6d8e35bb44be53ed1b276db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\w4ihiaNhc.log

Filesize
128B

MD5
49c04ff83e2babce957eb31c0487cba4

SHA1
e1d0ee03a3b3347208884b563bbe39e28de02822

SHA256
ad19ca848672a4468a63f8eff3444f9b6d32ce52bd3007be62f8334216650eb1

SHA512
d06ae7cb96bb5f108c5f8a50c3e505b6be174259ca47f224f4a2bc58109c288b64bd3100397fcb4bfe2e57a71d97bfe2732c4bedd008ab0565529071d3f0c4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
8a1303f9b06c7e09cfce8d95dcfd848a

SHA1
87f264c0271d05233546ae992f24a69b6340dfd4

SHA256
a7888d8e8d937968675bcf5022b3058810d82dc1a4945906b3479ae2a9105edf

SHA512
a72473209f0c03091dc83ad5412b45e0ab05d1d80c087b1a21ef8a85587d4fa79fbb303c50a6c404ca355194d36c4b1ffbee3d043e094987d79e8d086a683440

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2120-88-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-84-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2120-65-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-89-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2536-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads