mydoom | be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
Size

29KB
MD5

2677b0d14c373ee9f7cbcf5f3aba26a0
SHA1

a834a4ac2de305c8cbc79a945205e0d9ac3a1814
SHA256

be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4
SHA512

93fe4c90d470af48756625919ba5d04bfe0c359ccc1a8a772770cdd84f4bb4eac6183f14f343b33c39c039c18b874dedbd2a10acdbf15cac0e59b3de847554e5
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5E:AEwVs+0jNDY1qi/q6

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 10 IoCs

resource	yara_rule
behavioral2/memory/4668-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-137-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-157-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-164-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-201-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-239-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-273-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4668-305-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
540	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c91-3.dat	upx
behavioral2/memory/540-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000900000001e786-48.dat	upx
behavioral2/memory/4668-137-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-157-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-163-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-164-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-201-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-203-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/540-240-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-239-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4668-273-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-274-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4668-305-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/540-306-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
File created	C:\Windows\services.exe	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
File opened for modification	C:\Windows\java.exe	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 540	4668	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe	83
PID 4668 wrote to memory of 540	4668	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe	83
PID 4668 wrote to memory of 540	4668	be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe	83

C:\Users\Admin\AppData\Local\Temp\be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe
"C:\Users\Admin\AppData\Local\Temp\be47c93a4f998fbdccb01d2539e945538ebf45b87dc052e5f02aca037ac919a4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\default[1].htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[3].htm

Filesize
304B

MD5
267ddfdbb8d492b25de208d84b290f1c

SHA1
9f57d9f19f25549e1232489a0c101a92e851de2f

SHA256
ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586

SHA512
0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\defaultPRPUB10P.htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\default[5].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\azlQy.log

Filesize
320B

MD5
29c5491c7cd0421e3f23fcf5c1c3ad52

SHA1
27d28e2654837634b7739b59cc15637562482d07

SHA256
11dd007e37773ca46481f82bc06b44e1559b991c6196914acb4e2a005b04382d

SHA512
f56f13cdb1838762e8e5a804a32a43db815c67582d68dd3bb88b08e901182bba13b2d078349dd4f1fd4bb4aed8f65ac97d835f31de08dbc4d41f06f20bf714ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp943E.tmp

Filesize
29KB

MD5
c01d653e860a0f3dcb61966eb42f9720

SHA1
e62f6a9543f84cd47ff95fd1800a25f36cae6288

SHA256
4ea12ee5f5948064cce21382a433fa9d00c6a4dd312eb32a0467e5a9f25d2b57

SHA512
0749e2ab07e24e52661e070c8d6afb2291757e228da1ef0bd6ef767d9dce3d24086afe30790364306ba7e46a16b5d7d4029a2b377777f663881289eaa27a7861

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
54c48e544f74b51ff42cb6f4082e545c

SHA1
dede9dbef32f91049ae2976907c22e990d8ef3ee

SHA256
a63be5f9b6697547da78f84ee4a6c2901ddc1d770ba3815ee3b865503bc023d7

SHA512
ceed7ac666590a58deee7f3f7d9c04532a0d3dd53678c9d6b47da7697f9f3f7b31d886f759603d889a5a072e722cd49e7e042fcb258f83e91690d77881922f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
ec217778814319eedf0b8fc90d5459f5

SHA1
8f3dc3624552e54eb14e314f5782e45efcec0cb0

SHA256
770e6ff3d376d8cba681f2feb9cc3eb9d3e155a039f5f6b5486771f1ff82a0a6

SHA512
7aa4016c46146947773a7ea46f45682fa83b72073e7227b254e88646e259a9c639565131908c53e5d62a8d9a269ae16db1ad2598cd589ad6a54c11babefd80c2

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/540-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-306-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-203-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-163-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-274-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/540-240-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4668-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-201-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-239-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-273-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-164-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-157-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-305-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-137-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4668-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads