mydoom | 2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd

General

Target

2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe
Size

29KB
MD5

579c2dbab4e95d63682bc9d7969369d0
SHA1

e4d5c07d2ac6c0f573d679c6c2519887c1b1442b
SHA256

2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd
SHA512

8e9822366339bc94bbbccfcd740221eb37e63387e460d51e6fce6b5ca510f29d0b67508cd56c6ed77a54de44194ed80f54dce15a01d7810ee7f4e88da657da2a
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Sa:AEwVs+0jNDY1qi/q6a

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral2/memory/4716-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4716-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4716-51-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4716-150-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
520	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4716-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000a000000023b93-4.dat	upx
behavioral2/memory/520-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4716-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/520-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/520-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4716-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/520-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4716-51-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/520-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000705-65.dat	upx
behavioral2/memory/4716-150-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/520-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe
File created	C:\Windows\java.exe	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe
File created	C:\Windows\services.exe	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 520	4716	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe	82
PID 4716 wrote to memory of 520	4716	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe	82
PID 4716 wrote to memory of 520	4716	2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe	82

C:\Users\Admin\AppData\Local\Temp\2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe
"C:\Users\Admin\AppData\Local\Temp\2363c7469f8474cea5e0cc1bbab3dfd3ce15ff7214c0ce154158364551ef89fd.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3198.tmp

Filesize
29KB

MD5
9a20ed35784e4d77c787a361d312da93

SHA1
e88eec49bc0ac202f48814be5c28d4fa530da672

SHA256
6433552edcbd2e218c8f4e048d5a3c646ab47a6d2245624b08fbf3c329b0b381

SHA512
6c6f6218812ae34d87bd47abfce76006d6bb3438e9a04bda67301cc94c8051dde94de4907804fe97921f8aecf86f63beb179b1bafbf3735d3b0c4064d1f132ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
745560c4f6dbf54567da725bba4422c5

SHA1
1004e4451cf3b53715bae7a187b34a2d840bb414

SHA256
6b47b59be76675d7d481a879c0497d98aa564261007426ed72b075c6eda6394a

SHA512
4177cd50009613b2763bded5286e0ee2fb1ced07c4ac744c5ea2e7574c96ca2b98f745e2093558ead8651633b64c581370d616cd91770b984b14fd0780641900

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
f58f2927028e3a93615ecd3a22c55e25

SHA1
829625ad2ac2ad5d7dc6fba10df1192e1995ebd9

SHA256
6d2642ac50e922cead7fc542ad19a74efa0f917eac43e511ccdda491c2c12c61

SHA512
eef7e52bc3e86ab9f41a1bc30b7fd4aaa8fe2eb6e24d269c2c751579c98b447c3b76495995aca05a58d5641a3edb594b0cde42347954994730312ddbf4e564c6

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/520-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/520-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4716-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4716-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4716-150-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4716-51-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4716-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads