mydoom | ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e

General

Target

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
Size

42KB
MD5

1e00865531f319697131cc2d4a78cbb8
SHA1

5e8a8c6182b457c6482f7bcb56294ec71d86d124
SHA256

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e
SHA512

fea02797a020f3d9c9c48b982b07c61f37e94c2d69366f63b5c08c2285fcfc7221f9e0ba80b769932bc4462f232492b14db35b66f1cc0a07156997f5f27c1adc
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Z:AEwVs+0jNDY1qi/qh

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/680-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-91-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-146-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-150-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-157-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-196-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/680-217-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid	Process
1872	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exeservices.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/680-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-4.dat	upx
behavioral2/memory/1872-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1872-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1872-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1872-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1872-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c000000023ba9-43.dat	upx
behavioral2/memory/680-91-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-92-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-146-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-147-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-150-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1872-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-157-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-196-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1872-197-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/680-217-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe

description	ioc	Process
File created	C:\Windows\java.exe	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
File created	C:\Windows\services.exe	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
File opened for modification	C:\Windows\java.exe	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exeservices.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe

description	pid	Process	procid_target
PID 680 wrote to memory of 1872	680	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe	83
PID 680 wrote to memory of 1872	680	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe	83
PID 680 wrote to memory of 1872	680	ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe	83

C:\Users\Admin\AppData\Local\Temp\ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe
"C:\Users\Admin\AppData\Local\Temp\ea35312e6abc1ecded3a482a2b32ed734015e38dfbb20968adef131867a0097e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp67EE.tmp

Filesize
42KB

MD5
5f25e362e25a22e24d95a843fef9ef7f

SHA1
0be6c07f446692fb2a66a8a1b8ffcc6492ca5535

SHA256
6f41774748461e4d1d2d858cd02ba124057aaf0b3ed2d609b9b4842416f45fe0

SHA512
a308ece388f113bdc68550b6a8f9387dfc7390998989191f6e28481d766bdd86f68490a7e7d2e16902a1cea5d1299873197049c5bdc522bbd1e46f15b791a360

Download Submit
C:\Users\Admin\AppData\Local\Temp\xs0fkpfakf.log

Filesize
128B

MD5
18ca8ff34e6bf60574249bf1ef579cc7

SHA1
7bb912a33727096e539b279e17696229c794cea1

SHA256
8c9f3d2c7fa2aaafc517f4144bcd0b0ab075ffd5d00285902156fa8463deb209

SHA512
d6e0e828bcab72f5068d90134bd4199f30895d827d3d19744b90d7e6b9ba6c884549a51d03cf8afd86da77a55c3fa1d97cb517a650868ad838c8496590e7ec93

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
9c81688f427c153111ef83e0392655d6

SHA1
170dcd2ce8243c682a49736c94094ed0c4003847

SHA256
d79aae3a68adcb3b55e10d27c0a5489a1e81c764db6844deed6b53f85d684cd7

SHA512
114d5ae39364777415296ec5d893a91fd415391b501520582e4a6af1740aac38c6a666620ef4b411119d017bbafc8af9438d3d1b6bb43822983b3966dde940bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
d226ffc009aaaec33bd510f4798adcfe

SHA1
8506312df2175913beb0b95726d4086645d0b29d

SHA256
0745e19bf3b656c8b636a55ea4036d95989a83401068fa5fdc8233c54ad26f41

SHA512
67196493b2e8a9b529abbcc1eb17c3d71f279a2c9317e9f041a9796a3ebf15b67a88ddb2cf13cff934f0ebd14461f761c9514383a3124747c74fa51f851a897c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
160B

MD5
a36cbb7914110e7627457b4fb8e9ccdd

SHA1
0ba699ed3083b3d47ebec4d931a9bc34810db00f

SHA256
3e5613ba85f03fb6dbaa958387dab5fd85375d5c82cf72be91e97d994aa4b50b

SHA512
398632d20311d7dfc9dd50d3031e7c182bbd7d8e7a4ee62022b27ac974567cc44b5e246a9e6159114782610602cbb6a72a410c60c3e387eb7c0593e962c6ec96

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/680-150-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-146-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-217-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-196-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-157-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-91-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/680-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1872-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-147-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-92-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-197-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1872-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads