mydoom | 944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa

General

Target

944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Size

29KB
MD5

42cd14cab526404c895c96834142a0b7
SHA1

d3c280707847d714e98d82a74076837fa08ea68e
SHA256

944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa
SHA512

482b421826576d888c8919a541a249b51a8c8b8c68f6711183a08c44485c33a101f1c98af2c8d18f485c52346bef86ad2b576afb8a5eace7e1b35e8a39785c90
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/VO:AEwVs+0jNDY1qi/qw

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral1/memory/1900-8-0x00000000001B0000-0x00000000001B8000-memory.dmp	family_mydoom
behavioral1/memory/1900-2-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1900-17-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1900-48-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1900-66-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1900-70-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2340	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000016d71-10.dat	upx
behavioral1/memory/1900-8-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/memory/1900-4-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/memory/1900-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1900-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2340-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1900-48-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2340-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2340-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0032000000016d04-59.dat	upx
behavioral1/memory/1900-66-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2340-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1900-70-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2340-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
File opened for modification	C:\Windows\java.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
File created	C:\Windows\java.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2340	1900	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	30
PID 1900 wrote to memory of 2340	1900	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	30
PID 1900 wrote to memory of 2340	1900	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	30
PID 1900 wrote to memory of 2340	1900	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	30

C:\Users\Admin\AppData\Local\Temp\944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
"C:\Users\Admin\AppData\Local\Temp\944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC948.tmp

Filesize
29KB

MD5
5a19c4737c02156706479b79be44931a

SHA1
48a594d17531b0ac6bf83ed4e4e9a771c90bf971

SHA256
892520ff207be7f0dfc610ff932073f07cb5429cc11740b3b65efde5d5732964

SHA512
63eed6b5b786ec2c89e25997425a68c6a71149048a313c32185dec79f670884a670e1b4a5c6e12ecc13f77945cc5aa171faffae7b8df195ec3c37323f8f7a420

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
03c49a6dfd2655edea4dd4c36e76eebe

SHA1
92250716a74f89392f5d22d18cc4c9818c978d2e

SHA256
3ce7be4a6634d2f20a471526304eaba68b3501386167ff125f861314f809cff1

SHA512
a19147a70862c55fcae8b7db901974a7f4bc994a6fa6d61ce5c49951355b2c1f9c62f37f1d3ddf1c363cdd42bf8fcb952e8759d51660c5dba98c4a031a6e0948

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1900-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1900-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1900-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1900-70-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1900-66-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1900-8-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1900-48-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2340-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2340-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads