mydoom | 8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a

General

Target

8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
Size

29KB
MD5

ad1aa9a7f1835f3c89c36f96bad3d3dc
SHA1

ef5fdd55d8cf32a61f2bd0c44ad40001f793ecd6
SHA256

8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a
SHA512

201303cda70bdaf680af4eed982c685d87c933f55217a3574402874a9d3172ad61df04b3c43b6df2e58b1b98e757a02eb29a51e48b7ebae87154cfe9e02002d4
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/U:AEwVs+0jNDY1qi/q8

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral1/memory/3004-15-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-42-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-47-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-68-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-70-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-75-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-80-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/3004-82-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2872	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/3004-4-0x0000000000260000-0x0000000000268000-memory.dmp	upx
behavioral1/files/0x0008000000016dd0-8.dat	upx
behavioral1/memory/3004-15-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-42-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-47-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-58.dat	upx
behavioral1/memory/2872-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-68-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-70-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-76-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-75-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/3004-80-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-81-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-83-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-82-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2872-88-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
File opened for modification	C:\Windows\java.exe	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
File created	C:\Windows\java.exe	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2872	3004	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe	31
PID 3004 wrote to memory of 2872	3004	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe	31
PID 3004 wrote to memory of 2872	3004	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe	31
PID 3004 wrote to memory of 2872	3004	8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe	31

C:\Users\Admin\AppData\Local\Temp\8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe
"C:\Users\Admin\AppData\Local\Temp\8507c445435d47d8f506bdf80a187117dd312adcbd7bc7aa2c3ce14c3ddaff5a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66fd7a0401acdbf0eababfd7820f3a9

SHA1
6556a57320de6708e61ab02d41496cbea9655129

SHA256
f861eb222a72ad42e5baf425f1b98b6fcce4fd60ba95f8cc03c14e4db5c928ca

SHA512
1ff218e241b29d350c49c2ecbbc15826fa8e27491d55bc8e0eb3c77861c0cf3b0523ed34cf4d24487e73ed2b4b769e135b5392bb80f9c8e442cd0954a5713cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E08.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EA7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1400.tmp

Filesize
29KB

MD5
2f2d122bf1cce0c2f8a6aebf027b9b9a

SHA1
d72d1f96d847e1589d7c9f73e9a0e9f3a6f13654

SHA256
05aecde549924ac70c23660f54f376d1d77a3a10fd6063363ff330ecefe9bac1

SHA512
10bb3359dca6767d1fc058a1aa912d0f3cd951057f62672e91ddbf627a6500cb3f584103e9e14de2c705052bf86509df7013ac031c796a2a93e09f5f1e534030

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
463146d5ee537440bb2b3dc734282ea3

SHA1
ca9e93a513953984de88a07c5f2f0e7dbf7dba78

SHA256
60ed80dc0b303c9bd58f93c597bb03c2c0609f210dbf79574854520cf633ed19

SHA512
9335f4b694849421416a5913fd96053dfe94d702e4c0308e1c2ce5656de9e6a6c76afb8a9641655db10f5e42f4d670be9d3df9e37fd0bce97e51a1864fc017d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
eca5478819d27a38e91d79bd38fca0ef

SHA1
56847ad126dacf243e22689567c7f594d43479a2

SHA256
a7d4a931c2aff6b3abc353424cc1e1318646ca8851652d4ce6c021a6f5cab6e8

SHA512
6c23e9a5eabd14f06039551f193c36c46ed405e039dbdc450132a1e29d49a44492466e91431e14985d6f21167767ae39c477507fd62098ea44daa81ea3d688ac

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2872-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-83-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-88-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-81-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3004-70-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-75-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-80-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-68-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-82-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-47-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-42-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-16-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/3004-15-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3004-4-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads