mydoom | b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99

General

Target

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
Size

29KB
MD5

ec9473fb4caa3d8c12cad954a75c7580
SHA1

d4ff0504c7ed43dddb973fa1c51647a53712f83f
SHA256

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99
SHA512

d69e6d5ffeaa15a1c762fc1ca97a41c31b0429949f4b04b14c33b9458020e2085f60fec4eed0fadba60bf23962f987c30b48f709907acf4ef774cf0a99a5c10f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/i:AEwVs+0jNDY1qi/qq

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4932-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4932-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4932-106-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4932-149-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4932-153-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4932-160-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid	Process
3828	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exeservices.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b80-4.dat	upx
behavioral2/memory/3828-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000022187-48.dat	upx
behavioral2/memory/4932-106-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-108-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-150-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-153-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3828-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-160-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3828-173-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe

description	ioc	Process
File created	C:\Windows\java.exe	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
File created	C:\Windows\services.exe	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
File opened for modification	C:\Windows\java.exe	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exeservices.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe

description	pid	Process	procid_target
PID 4932 wrote to memory of 3828	4932	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe	83
PID 4932 wrote to memory of 3828	4932	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe	83
PID 4932 wrote to memory of 3828	4932	b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe	83

C:\Users\Admin\AppData\Local\Temp\b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe
"C:\Users\Admin\AppData\Local\Temp\b09143c6ff8ae46141a33f04355ad8b7f9326a8286a81e017e137d89f7104c99N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\default[1].htm

Filesize
311B

MD5
7aff9ab510d3978e4375fa686729f3d1

SHA1
9dac99bb152e6278294fa19008f16662c988e205

SHA256
64e0b3228ff8de15e5a74e7ff8b7cd163fcbf638f6380aaa6fbee8e40cb2c1a1

SHA512
3d73380958518a5967b9c0d74f239fd15c694d3d957135d61955bc4afec548efcd5434bd3b37ab8efacafbd7672d969c7a3fce9653e78a3f11793a78ec2867d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp61E4.tmp

Filesize
29KB

MD5
5f2693ad4bfc900722b79faafbb2f38a

SHA1
fb7918e487742b58aa07c717e31d3d7b7e4e35bd

SHA256
6ec3c42e2eede1878a3c71ccf92128520bf12ffb0b79993f76d455dbcb54ba28

SHA512
e43de0e595f65c0d990510c7ea48022588ad0587d6dce704b0a4b3bc225d443b00a0b6395e30b0e87c8665248ba60e5525faa42dd5aaa9d19e03f02c09121048

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
ffe300c793c1e5c916645b8898d0bbf9

SHA1
979434d9ca291f1067a5b0052aab32f9e860185d

SHA256
1a155ec99e425d2217b2d9dbf8bde30d3a3f6940b379b534bd5b7b730729f346

SHA512
ab2061ade1959155edd41c57ce4e4ec3701b8d4d1c38109b7b8e28ff65c7c1562e8602ab69321f5669a88e3d11b1bf8c1adb1d8f2a7bcd588e0897b9d13fdc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
2f243251080e82431a72c6e29b2d5da6

SHA1
6e13091308db05506df42e031f3b18e27c5bcb77

SHA256
75fd5fb0025cb164b5a3b3ba9acc8c796996712d43777d2a33d091959cc06368

SHA512
bfcf9feda0b1048209ec75e2202c042b20d45c89dcf17dd698ed573963cac24fd6a7b85a7b8ea65e9f185b7fc373acd393ccc1372f24c9c8c3a147294c694c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
00450905773ce28d14ca89c3d946e8c6

SHA1
31ac7ac4c72483f0a229c2e69071e4e8658ae947

SHA256
ce6e98217a4d90f6ba80ad745b936b1c330be9731b7a76a63af40ecb540cd0fd

SHA512
24148f1442888e097c5aa434832244c46cf2e27eccda0253e833977f11e14128ade597be6f01fa8305736f57abc03fb9be158f4c3ff80bc9858b57e0b9950fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3828-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-173-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-108-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4932-153-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-106-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-160-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4932-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads