mydoom | d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056

General

Target

d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
Size

29KB
MD5

ac3b4e176e8e386f1244498ead19c685
SHA1

522a0d5c369d60a9c0a47e6cf7f9e39cf6f783d7
SHA256

d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056
SHA512

41295bf905de3842e672f17143b081eb3cac0d16d13a688ea4e6f1e2c3ea51fb283460240807d88baed3fdf4e7e8d9fe53313eb83fc5b08fff80c04dec598bfc
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/8:AEwVs+0jNDY1qi/qU

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral1/memory/1872-15-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1872-35-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1872-59-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1872-63-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1872-68-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1872-75-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2548	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1872-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1872-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x0007000000015d9a-7.dat	upx
behavioral1/memory/1872-15-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1872-35-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0003000000013d08-46.dat	upx
behavioral1/memory/1872-59-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1872-63-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1872-68-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2548-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1872-75-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2548-76-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
File opened for modification	C:\Windows\java.exe	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
File created	C:\Windows\java.exe	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2548	1872	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe	30
PID 1872 wrote to memory of 2548	1872	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe	30
PID 1872 wrote to memory of 2548	1872	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe	30
PID 1872 wrote to memory of 2548	1872	d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe	30

C:\Users\Admin\AppData\Local\Temp\d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe
"C:\Users\Admin\AppData\Local\Temp\d1922436a615dd6f224bfb212761f2382528a76b5cacd8495e3477c9ae18c056.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB53B.tmp

Filesize
29KB

MD5
f6c7ec1781e27105034d93ef723760f2

SHA1
0ca852ca9a1e0d66edca4271e25e279f5e47a300

SHA256
4289d94ea1600e6ac03a45b70f281428aea7c5fb5f0bfa3da68eeae0917166b1

SHA512
4040e0c4e0d05f4434f24c14ab463a18f863997189717981e5892cfb9fec21b04055dd0e56e087ec491f84782be6ee75fff9c62f8b62c5eee9401c8e946102af

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
352096542c677bc77ddff5ec245d03f5

SHA1
fddef3450e0c450b47e53414cb2a4921e8ddd751

SHA256
a6b39ac7069583e0bc85bf46a846472aa49dc375dc6b6c45cbaeb421f64a6c30

SHA512
91751a2ec2da735cc5bea5113d4439eb66272149f019a90980f9cb104c08ec38fa47dc07762c214f40b4b2513eae5b7b524d9e256b4d04b748351e331065f170

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1872-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-16-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1872-15-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-75-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-68-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-63-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-59-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-35-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2548-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2548-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads