mydoom | 115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327

General

Target

115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
Size

29KB
MD5

273903f43bb98e4d8e3f16e6c81400b0
SHA1

a008f66677bf3f95be3bc009e5424fdc7ff7e187
SHA256

115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327
SHA512

c2efd035190d37095085f6c44c2d2c2489fbff71ecc79f63c0bfa26435b7fec54dc7a537ed84c2f2d642b6d314d2c5a41ef7a43eefdaafa1812bd995794317ba
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/wh:AEwVs+0jNDY1qi/qK

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral2/memory/2988-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2988-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2988-130-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2988-172-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1316	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2988-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1316-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0007000000023c97-4.dat	upx
behavioral2/memory/2988-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1316-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1316-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2988-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1316-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000707-60.dat	upx
behavioral2/memory/2988-130-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1316-135-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2988-172-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1316-173-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
File opened for modification	C:\Windows\java.exe	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
File created	C:\Windows\java.exe	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1316	2988	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe	83
PID 2988 wrote to memory of 1316	2988	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe	83
PID 2988 wrote to memory of 1316	2988	115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe	83

C:\Users\Admin\AppData\Local\Temp\115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe
"C:\Users\Admin\AppData\Local\Temp\115ba22011a0d8203a762247c8cf685754b130e8771592a7d3836aa229dc3327N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\rxkn9ioex.log

Filesize
320B

MD5
e8c7c2599eefa136f4546e25a8292a33

SHA1
acce37a0974075989f160d86b1a5ef008b286d33

SHA256
320b1f9d3b234703b0c095f8fe50440d9fd21f167ede2b688eb064e338fd87b3

SHA512
6b568a72557e138546d8db19355eaf749cc8736afa7ebb9ec5c9db036b9ad38d931bda771fa29aad9bc1624eacef5d219b80b046f16802bb2db636a150cad3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp49B3.tmp

Filesize
29KB

MD5
7fb3421a0208b894b298f372306ec646

SHA1
9e75c7932829f164fda8231aa1459a8a340013a6

SHA256
ede3a163a6bc9fc0a3bf93092c63eb97a624465908d69f88bf186674410afa46

SHA512
d0a73c5bc137378ca6c1e05902240a9cfab5febe7a297a26338cf740fd7aee24ea85661a7e89123d44d9a5d4239c0ac863302c2902519e8decf19c9761a9e8c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
6d2a816979a780818e5d6ee673e931cd

SHA1
db9adad5821a249a901409fcc677dba7a9b59b4c

SHA256
994ee860e3327dc8be60dd0baad4b8f5e24f026642f7f09ed4cc4a365c1447e7

SHA512
d1c9136777d17642676374b974584fd3fd6c8155d1a5227b03cc370d6676c58212a4272d5ea477e74ef3dda13438ab33819a7c7619c5fda6c6e74deff9bef0ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
203a9e1e5c9d5c65151336913afac991

SHA1
7d9293a94c8721e446a42f7c7a5e7234de72415a

SHA256
eedb3e9b087a12b169e9f964e0c141ecf90d41ae91acf9339a7dae35419b2b1b

SHA512
5a344286c8276c278edb3a6d453b413e06bcff5957816635564261e76b9c81c8722e808f64a868e60f2afd9bcc887cc1d2f013fda5ea13997068e82bb890a88a

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1316-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-173-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1316-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2988-130-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2988-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2988-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2988-172-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2988-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads