mydoom | 5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185

General

Target

5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
Size

29KB
MD5

d743d44f7a668dddda97efa0730a36fd
SHA1

fe0fd582d7f92280ff98e478f41ac3564ffd3763
SHA256

5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185
SHA512

fdf6c9fca6bd41a34e7c7fb80251c2dcb1b2ea5fbf7ad40f0c59f51257a09c6854490f525fa9deb0c72b1a7303cd4923b30c7738bf5b2cfca97139a40c1f8d61
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/a:AEwVs+0jNDY1qi/qi

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/3832-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-131-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-149-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-158-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-181-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3832-212-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
828	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3832-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-4.dat	upx
behavioral2/memory/3832-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d0000000218b4-55.dat	upx
behavioral2/memory/3832-131-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-132-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-158-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-181-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3832-212-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/828-213-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
File opened for modification	C:\Windows\java.exe	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
File created	C:\Windows\java.exe	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 828	3832	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe	82
PID 3832 wrote to memory of 828	3832	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe	82
PID 3832 wrote to memory of 828	3832	5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe	82

C:\Users\Admin\AppData\Local\Temp\5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe
"C:\Users\Admin\AppData\Local\Temp\5f42c0984032dfbc5be262cae6c30d5aebb762c4b73c4365744924433f11d185.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\default[2].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HOI3BGS3\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF579.tmp

Filesize
29KB

MD5
d22e4a0386a30e73823603008bc4b480

SHA1
22a6e51f3ece49856e2af514174c55a8d7c4d09d

SHA256
0e34aa07ea985222dcab308b316a0f261e7e7615cd0d827157ac933ba034faf9

SHA512
980e632208a1647e5d984a77573fe73ddac24725887f0f2426ad16339f89d0047cdb951e8bad1495610359bac62f751757627e504bf0f7d114a7b8cd3811e065

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c26e5439cd87b8182c1d7bf158ba32f7

SHA1
ba27b07e671b215796b67551ad662f044544235e

SHA256
b9e17249e075c6a1f1e60fc0afa7b34629d9ea315355c89bd44e7586b26cfc41

SHA512
e136f7fb948adced6212477ae4352acb3cfb2e0982718fe8cadff8a9b9ef304ae5587ca703b7d048dbdcd5e324b2ba9cc56bc8d51884da1b835662ed02872c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
a2b1b217c639ebadc5974fd069c6886f

SHA1
264dc8d905c947b7ae75517bf9456a38bfeffe7f

SHA256
bf485c056c15e4b13b8eeae14902ac446cb30ded764879bd567b7bb93ca10986

SHA512
98e7f5579f3fd98778097107b1ba3da28545fe4abef5bf7325517f158b7625930ac27a9957be8e6faf1cff1461d8201509ee76585243468051f580710d18b340

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
55299dc243e00656b37fbbac74194e05

SHA1
740a30c647f97987539a7ecb8f0f247c42900e0f

SHA256
8a75220301ff6df4006464482a038af511bf7d4d3a0cdd96b89b11653d5eba85

SHA512
96f38c535bee3d3c384899ad8a0eb0cfd3316f9ba0e01eb4d0a1bcc69802fca173a035aa0ceac1e363542c7a5096ac72f3c45bd80b185b2b194b50d2479926fb

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/828-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-213-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-132-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/828-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3832-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-158-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-131-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-181-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-212-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3832-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads