mydoom | 14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
Size

29KB
MD5

bfea510073893b24610c2af19cd8ceb0
SHA1

2752a6ea030ea24e0e7ab05da6738b77929774df
SHA256

14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206
SHA512

e464f2b6c4f7b2bd74a28f40145c83d768470eaea19512f5f2a7819f5daccad02c334abe0dcc139f22d1d93b2d47c7a07054c5cfd5b61fe8af43e330828f2b8e
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/s:AEwVs+0jNDY1qi/qk

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/1652-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-109-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-143-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-152-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-176-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1652-208-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2060	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1652-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000023b9a-4.dat	upx
behavioral2/memory/2060-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2060-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2060-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2060-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2060-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023c16-38.dat	upx
behavioral2/memory/1652-109-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-110-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-143-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-144-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2060-148-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-176-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1652-208-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2060-211-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
File opened for modification	C:\Windows\java.exe	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
File created	C:\Windows\java.exe	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2060	1652	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe	83
PID 1652 wrote to memory of 2060	1652	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe	83
PID 1652 wrote to memory of 2060	1652	14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe	83

C:\Users\Admin\AppData\Local\Temp\14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe
"C:\Users\Admin\AppData\Local\Temp\14e4c1ff31d2128c6b4322ffb017bd4ae63dc27ed2a1c2235b647871dec88206N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8B3ZU6S9\default[4].htm

Filesize
312B

MD5
e5c2364375c0a8a786a9508a840b6299

SHA1
bec1874db0d2348274b6656d1383e262f73e2bc6

SHA256
51b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3

SHA512
ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FGDWJGSY\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\default[3].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7318.tmp

Filesize
29KB

MD5
1cbdd4dae11d40d57dec023f33794db4

SHA1
764422d3c6d26540909084b618b54e1ec8e851d6

SHA256
c1239e93638465bd92cc6e74a0b76d64ec7b2f623318fd76078589b46c0f4f1e

SHA512
5fbd2b9a5fb7229f6da89bb023b2c25e73ac81fc866f7290459413cb2dfadfbffefc54cd9c6164e127e7e3058b55271188b880bee4ae6f6d8a539ec1266c7f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7427.tmp

Filesize
29KB

MD5
94e8e43ba61ff39cb26f594daa3ad00d

SHA1
6df0759019aa04c9e2b0ffae6e6934caf286f767

SHA256
3c3da9fdce68f832150e2dcffaa7cefa46873ce6698f6a03c4e905e77374287d

SHA512
dcac523f04df790aaf5aefa3cbc1e517dc662f94b09ad5f290a8c998cc1c20c0f8de092cb365dc00e0cb04167bdec1d07ece255ad7d81ba20399e60c1897388f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
5c00136846c5a700e2cf69a86f33d9a9

SHA1
634c8742e78fb28beff0e44ca910a4bcd8c54f5e

SHA256
ac839f92038c519e5487fffa9514e93cffc3dc66beb36ec79c44f773956208bf

SHA512
c47de6c8923922fc8e8c216928ce9c80768c9696db7bb31fc4f74c765be94cfb54d2060211b00746aef14277869e53c00e0a0542cd9a46195fbe44573f39d882

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
78501d5343400c4497c13c79429fe7a7

SHA1
607fc72644df463b5e715454ad7624819739d667

SHA256
16d8d8365c233e48de878f49c7ae2e4b443b7536f43866194d2962a61dcbdef1

SHA512
f7579b288b9b23dc7bac5423e20d31a62b580bc84ba36c2951e58130b64d2dc12d8412e2c09974a6c88e50d68cec69b8a6582f97d4c9193f181eb8bc8662cff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
15e14064d9ee5d65490ebb060b8e00c0

SHA1
a1b30c15b798509024a9b143d9c8227f4ffe9ef5

SHA256
8d24bb34d7f99386698ae0fb0622bffedcca04517287ca4002e86173a1a96994

SHA512
074c7f264707dba57114c8ca4c450ae07ec8aa8380733cdc5e98ebec8d18d4fa5f44479bedc399bc3dbab6fa32b3270c0382d94065288323454e4ab8fa480972

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1652-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-176-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-109-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-143-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1652-208-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2060-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-110-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-144-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-148-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-211-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2060-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads