mydoom | 944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa

General

Target

944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Size

29KB
MD5

42cd14cab526404c895c96834142a0b7
SHA1

d3c280707847d714e98d82a74076837fa08ea68e
SHA256

944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa
SHA512

482b421826576d888c8919a541a249b51a8c8b8c68f6711183a08c44485c33a101f1c98af2c8d18f485c52346bef86ad2b576afb8a5eace7e1b35e8a39785c90
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/VO:AEwVs+0jNDY1qi/qw

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 2 IoCs

resource	yara_rule
behavioral2/memory/216-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/216-56-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3904	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000d000000023b8e-4.dat	upx
behavioral2/memory/3904-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/216-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3904-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3904-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/216-56-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3904-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0005000000000034-62.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
File created	C:\Windows\java.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
File created	C:\Windows\services.exe	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3904	216	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	82
PID 216 wrote to memory of 3904	216	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	82
PID 216 wrote to memory of 3904	216	944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe	82

C:\Users\Admin\AppData\Local\Temp\944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe
"C:\Users\Admin\AppData\Local\Temp\944eea6102363852a84b624000c6c45edc88b8743ed60ce7b4665c8048b18daa.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp41F1.tmp

Filesize
29KB

MD5
5ee8bf66cd543c2bf0d90c2abf621b00

SHA1
4f5ed66c33257ae5af0ffe6a71288974522d5104

SHA256
14a3cb089c00982e3aeec39e7972c2d1ec008cada70fe0a6136bd213f7782aa5

SHA512
02e5c0564614d93c927cabf65e1e7450b62ac6bcc55ca11d952ddf863c19befbda11c50ed65c434f5d869076c432a1fe226502ca646db759c99b88ef46cd2250

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
46d615fb01a5dfc6399efacb1816dce9

SHA1
d69715fef84ab2a72d76b4db6c8f6e2f237f626d

SHA256
80b27e4b31037d096643aaea396df013a6688d11c5108bb1ee099ee277194fb9

SHA512
920cc735d70f467134e447b6b96e6e4b49c2eaa3aa52791d59cf57141cbf6366650bbe2ac143244234754ae36089a64868f4c75363adc670626c2db08338f6f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
a522e76172c25feb27cefc7d498e2b22

SHA1
98452d56a1f14d87cdb60c1ebad5bdb0d942aa35

SHA256
a695dc30547bda3468b4275a2a343423729770137ecd0839678519828bb39345

SHA512
76e027f6a291b6ca167b850caba5f378b6519540f25ba80c4849643c2b765349da3975769b605b66f522da8790e4965d0c0544652d52c6be257d2fc9d7a9f5f4

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/216-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/216-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/216-56-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3904-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3904-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads