mydoom | 0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
Size

29KB
MD5

8f8e60da9a2ec56841b2993fdc73af71
SHA1

a7d4295d7dd1d023ce8d18358f7617328b0374bd
SHA256

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1
SHA512

5580d66e7f4b9bafef338ec0949c69d6f85eccc1bcc05986295102b26398f636d52c021cc85d7879247bc1c1620f59fb4a84898a121e18713536cc29ccc88c7e
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/r:AEwVs+0jNDY1qi/qT

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3748-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-212-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-253-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-260-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-281-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-286-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-317-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3748-372-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid	Process
1960	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exeservices.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3748-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c93-4.dat	upx
behavioral2/memory/1960-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1960-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1960-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1960-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1960-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023cb1-48.dat	upx
behavioral2/memory/3748-212-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-213-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-253-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-254-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1960-259-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-260-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-261-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-281-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-282-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-286-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-287-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-317-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-318-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3748-372-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1960-373-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe

description	ioc	Process
File created	C:\Windows\java.exe	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
File created	C:\Windows\services.exe	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
File opened for modification	C:\Windows\java.exe	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exeservices.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe

description	pid	Process	procid_target
PID 3748 wrote to memory of 1960	3748	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe	83
PID 3748 wrote to memory of 1960	3748	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe	83
PID 3748 wrote to memory of 1960	3748	0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe	83

C:\Users\Admin\AppData\Local\Temp\0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe
"C:\Users\Admin\AppData\Local\Temp\0deb25f5ab6efb9724377c907b4667cd84b57170ec8fcc064cbb3b3f13b567a1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\results[3].htm

Filesize
1KB

MD5
e56e85bfcebc6b4aac2c01b1941eaf2e

SHA1
d29a8ed98290280a6c9189b4578b4425e473cf0b

SHA256
e947ad31eae263e86a3868757def3483939a505c12868525e21b433f001ada5a

SHA512
32cf41840274bcfcd82bc31ec9ad1b2fe1bc4d7363232e04d1b36adbeaa4dd669ab53f03fe76bacfd93a7c9ce726aa2427a65a31a83f180e565bad6e98b8a168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\RO61A76N.htm

Filesize
153KB

MD5
a83ce0094b0d5092d0de08282a0b8959

SHA1
480b42ea616107263c4af55b80804d246281e226

SHA256
f16edf34a5e4b74ea1c62c06895b5174884b397456a9107fb2074d5b56da5c8c

SHA512
46e7ac2e834322b09d5e7eb0408e7e0b4dee4f0ab3995816c3df56c9cc788060802c9023b65086173715fe2b60716c7994d05964e5dc96cdacb55697bf19e717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\search[2].htm

Filesize
134KB

MD5
80ecc23a4b54d9768b8ed5e36d40fc26

SHA1
3e59a99d762278da17645a1ab320f5f15b035900

SHA256
e06124e9991891a7e573be5776e6253707ccd511f7f2f0471eedc8a635657dd1

SHA512
0e20d7cb09fb919ae18f700b668fc4832682245b4fdc0e494d401d8e5092ceb766ba459cade4f80f10f439415b4b055adeb52b6cb02fd572b2a8fcbf0f0f71a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\search[3].htm

Filesize
134KB

MD5
b61c6d0ed68401a4261e584ecefcef2e

SHA1
76aca3d75f64db4f03e76f38cda1b3b7bbffa89b

SHA256
dc2826fc65c2762bf600e5d87bf2f0f6d7e2d855b38b53a36f14c44e2800b972

SHA512
4f1be579246615b2ef371a9f975b91a2717c1f570c7aff7406d3bfcf492dc38ee3b23b2e31d8f5111c7b85a63dfebd4b3d5cfa7a277cbd790b4116227b2aaccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\83RZ38ZY.htm

Filesize
153KB

MD5
cee37e3f512aa3a7c30aa73f0155a0e1

SHA1
c4bc39d9bc944664609e23fe339e90126e297cd8

SHA256
c58c0a5f71949b1ea19ded34fa9fd28264c3c8c4ac24d843a4c2b3eb5271169f

SHA512
2f0274356a59c336f436af99fb08e72ffb3bc90102aa7f27cb8c9e5524d59330c122d9bc2572555085219c162457c74d651e96558bd7f10c4a783b988a321f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\results[6].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\search[1].htm

Filesize
131KB

MD5
7dff8f8eff53c9f25db0cb7564099d3a

SHA1
d406a36241e8de9f16412eeaf4a1b321ffeb0dec

SHA256
53bf475d2c07a6a11651897eae84ff691e21f143712594aace7d8f0b78afdb16

SHA512
87b6e3b09b6fb772fc62220bb5dcb1957bddebb63aa9bcd82a82231e94697139f7de30b98a23fedd5545a3feb1c2f918a0513e7fae9e95a8952bd62390dec97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\default[1].htm

Filesize
311B

MD5
593192ca95413c197b2b34ef10fee9e3

SHA1
76efabd5fc9a2c297384883c8adec463e492896e

SHA256
ffcebeaee31d4944d14ed393a22bca4715f8d17f3580fa3e3d6f05d03732a8bf

SHA512
61be629d128309af1c36579e160ff30b14fb332f1440c048bf24620faa33f8bfd756e97398a4464e415abcfd39d0bee7cac57559b7ec29692c0640a2a76b361a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\default[4].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBC87.tmp

Filesize
29KB

MD5
444cbb7b9222f823483847e4e243b969

SHA1
4f721c7feeb12718b01b647787aefed7aa9121b8

SHA256
646a173bce89a3e5dbbfd8a4859f9d839161f2d367592e84741c01594d7a65ec

SHA512
daa32caa431d4c51926237dc1f49cf8256b8cc8dd30255e8d6ea006a15e2bac3f2b245d73c1ae52bd4dd64027c2bd5fad9b4332a4e6097c0c86bd36d416330be

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
1a500563195b2c395a0c87a1d94d4687

SHA1
27ae4f5e932ad33044ee8119dc402dd74d3ab62b

SHA256
7a5ace67af97b78c1ac37747be67b92d3e0b5790a10b05d36b2fe4fc31d6a5f7

SHA512
8f32c4945f2b2b3fbb61390fe8e54fd28c1757f0c8b82683f4396e363ecbf6bf081a191b53c40c2387d04292a6aa55767674b9174150dacf061eb995d5ec84ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
93575a4f8b9e025aeeee1d35bcad3caf

SHA1
9320614e0a18dbf2b3e7b6d7b7a7bb3183b212ae

SHA256
9802372e52502ffef0f3681df8dcb9c2889e7916702e53bbdbda6d9bad5038aa

SHA512
3c926d18f9aa762f146edb71a053444248cb8025df20142ac684a1ef8811682f80392a37a97f0ed7d2ac3b69e89d90cce28ce419a11f3c872edfb92e4dd788ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
b72ab9e522a170575a3731aa01b40d5a

SHA1
b9cc5acb902acedbb0888d281a626691c1fbf92d

SHA256
8b2b32ed415c1037d645281298cff356f90f9ce0d717ab31de8aac1eb56e6e08

SHA512
cad65a0b9543f19ee6fc9ea16840b5d0e8b8ba27808ee4c68dac1971f168d20894a5e64953ecb4427a8638491bc7485f56cd1d1c7b6988b3380625e6d72b64cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1960-282-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-373-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-213-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-287-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-254-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-259-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-261-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-318-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1960-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3748-253-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-286-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-317-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-281-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-260-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-372-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-212-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3748-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download