mydoom | a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe
Size

29KB
MD5

de1a5202999254ead6f6c16d2e4d88b0
SHA1

f3ddab28efc37dc9409a1199318f16d1f2ed6ffc
SHA256

a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275
SHA512

1bb2d9af668cdbcea73d2a0ad142c250f0ef929f7695491675731e826d975784ba5788f013ff29cee37991d9a6df5d76035f638cd3e8d4d3c52b3a9d3e326124
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/U:AEwVs+0jNDY1qi/qs

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/2928-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-127-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-151-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-158-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2928-193-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1920	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2928-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0007000000023cae-4.dat	upx
behavioral2/memory/1920-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1920-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1920-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1920-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1920-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000022187-51.dat	upx
behavioral2/memory/2928-127-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-128-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-151-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1920-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-158-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2928-193-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1920-194-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe
File created	C:\Windows\java.exe	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe
File created	C:\Windows\services.exe	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1920	2928	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe	83
PID 2928 wrote to memory of 1920	2928	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe	83
PID 2928 wrote to memory of 1920	2928	a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe	83

C:\Users\Admin\AppData\Local\Temp\a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe
"C:\Users\Admin\AppData\Local\Temp\a1c4985e04d772ce8aaa5e168b9bd161a0f55050a95ec198021c145ebd602275N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\default[2].htm

Filesize
312B

MD5
5431b34b55fc2e8dfe8e2e977e26e6b5

SHA1
87cf8feeb854e523871271b6f5634576de3e7c40

SHA256
3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

SHA512
6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\default[1].htm

Filesize
303B

MD5
716cb7f5b783829c36e49996fc0bf627

SHA1
63471c20af48dd7052d63a695a12d86e2fc6871d

SHA256
6ad9b32ca3ec43c9017ab8f11b6f82e7ed43083efddf1ef74a3165f778312b40

SHA512
c3d126513cad64785ae5a16c5564cee6d7da1d26682d93d00a04937d9f98a89f54c74f5dda0c200c77f092fd8092db4f4f7a7a8544057eeb83d058f28fdf0346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9364.tmp

Filesize
29KB

MD5
230cee0ecd404e418a5f7decd65975ce

SHA1
4743fa6cd1343cff60c7c62f622062d45989c52b

SHA256
6d06818bece3de8804aa6867ed0b9bac85ee422efafdfba0c697f7c565663d64

SHA512
b991e2bf387f6455c8811e3b8f32872bcfd73563f068e704f729b1f1e168603c9d341908e230b8f800b44c43c4c822143071c25ad183039604398f1e6559592c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
e8a8915cb0c7275d82384793e237e812

SHA1
23583111240a576b3b8969f567778013496ddd22

SHA256
c1d037c3d52d325d7ad4d997bdaa67ac2ed587ed74c7322c2f8801c990c2392e

SHA512
129fc01b938d98c7db212318ea1409ff9e1f33f3e46e7fcf0f445630ab31a947054d4590a6b5c5a7dfb95bc053b8a9ea8d087d510266e60c0f4a1911c24ab5d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
27408ad1fda37dfd8439cfa5d20474a0

SHA1
a52c253c6a3db1188b716239f075e56cf3b0e0e6

SHA256
82e8b93e036db4005f251b8fa85e9a0f4a5405d97295a2f1d9e4e385ca12e78f

SHA512
6c3f7b65fa90f0bc3030da4e71ffafe496ed08383f15270420a65776e9472ac2e9991d4d69a937b22a2b1505075b926b7fe447b0415959491cb49978239d371e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
367B

MD5
5e7e57446f1213266f02baf05156639e

SHA1
b8929337cb1afa8f500fc459c3cbc06aba01777c

SHA256
d96db7544b402ff5c901483aa4d2cb7104127f411b6928ca3b27bee81a54cc40

SHA512
46a5e43d84e7c93fb079976990062b35a992f6b3451077ebcb29ba05c4ea0a4a1c04ef2f449afca2a18320f86381f298777362900505b265a3645bbc01c48328

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1920-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-194-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-128-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1920-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2928-151-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-158-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-127-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-193-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2928-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads