mydoom | c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec

General

Target

c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
Size

29KB
MD5

0bc198bfe9e5f961d6b804f12bb7ec1d
SHA1

d40fd969258c3a9c5603fadde5cab23e59281bfe
SHA256

c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec
SHA512

6b570382318dabfa180ae277d1892bcfbb8cac27bd50fbd412bdf819b32df51b85f5237c95477496aeeac143057da0add0842e8119d9c4fe4d0191378d12f9e9
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Ah9:AEwVs+0jNDY1qi/q4n

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/4996-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-149-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-170-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-177-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4996-220-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2588	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4996-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000a000000023b89-4.dat	upx
behavioral2/memory/2588-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000705-60.dat	upx
behavioral2/memory/4996-149-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-170-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-171-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2588-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-177-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-178-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4996-220-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2588-221-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
File opened for modification	C:\Windows\java.exe	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
File created	C:\Windows\java.exe	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2588	4996	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe	82
PID 4996 wrote to memory of 2588	4996	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe	82
PID 4996 wrote to memory of 2588	4996	c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe	82

C:\Users\Admin\AppData\Local\Temp\c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe
"C:\Users\Admin\AppData\Local\Temp\c3a35fd5fdba62bed21d5ebbdefe0f8536f9a0093c48bb7c2da3b07aa32b89ec.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\default[2].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\search[1].htm

Filesize
115KB

MD5
eaa1af4857efe180ca04afd623a7b40c

SHA1
d3559c3fbd96df83a339721272d61b4c3a6bf1a5

SHA256
a9c7cf418489769e19957d5acf3586b0df90f6c0f2185b074e33e4be232a5e9c

SHA512
465e1c72539e9654748e8dea251d9d3188aa08571802a9737208fdb8ca709af3ca0d492b5a3f3fe1c959da33568b346c5d69db35ca8c286b68b91c32c0981380

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFA7A.tmp

Filesize
29KB

MD5
f2b6160e2734f16f1268b8519d74d2c4

SHA1
7c7ac4b744c88fd6137666e295de4e0d1e82ca73

SHA256
2bfc7914b03312ac0d931b3be8384cedb3871dfe5440ac65fa89c8aba67230ae

SHA512
90e1ea16034429cf70eb790b7aa3b7bc18761daa561f431e9b362d66ae3e7c48c52f3d9a6fdb5583eb1cefcbb688e87da710055c81524dc3bac90c2822cf6364

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
917ce712829bca5974f3dd591340665a

SHA1
80741f49426e36a1f91559d378f908df694a5de4

SHA256
3c2e4cbcd056a7dcc989a92a79dd3b32ad33420047da8b8e90916660041d5fc2

SHA512
82a7706c9cdcf0327d9a637a222a5017583a819e3c3fc95edc667717ab54bd1d1c8699c54a84aa83359c3f1786c1e3b76aebb27e344442614f148535e33cb404

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
dc04c5ae9e3001f69268505d2eff5caf

SHA1
5f2aeccbd9c7522a4fe2d4de5058b05f43ade0c1

SHA256
d92c38e10fa6791b80376a3af495806101a2ba5963660569c8d2a405eb823a28

SHA512
eb978bd9ef917f4df93e65660df7eec4ac790ff696d23475f1ae24e9e00dd984cb58b247e3baff920799dc1fbd02308899b4f88cef4ed417abb78fa16017457e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2588-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-221-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2588-171-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4996-170-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-149-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-177-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-220-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4996-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads