mydoom | 63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2

General

Target

63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
Size

29KB
MD5

45b47d4d08e3204aa9a8038dcb5687d0
SHA1

537b8e3ae342f33f0d70a4919663586a7fd612e7
SHA256

63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2
SHA512

3f255a9420843aef4efd0e84a9901b1b6c045508096e8caa5c1ca05c5ea76dfa0d284cc17408ed12cbe416597279b9d3d42c45d51151d4dffcf8ca66720e1c01
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/yh3:AEwVs+0jNDY1qi/qqV

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/1596-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1596-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1596-123-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1596-127-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1596-134-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1596-156-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1516	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b8e-4.dat	upx
behavioral2/memory/1516-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1596-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1596-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d0000000219e5-51.dat	upx
behavioral2/memory/1596-123-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-124-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1596-127-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-128-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-133-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-135-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1596-134-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1596-156-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
File opened for modification	C:\Windows\java.exe	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
File created	C:\Windows\java.exe	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1516	1596	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe	83
PID 1596 wrote to memory of 1516	1596	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe	83
PID 1596 wrote to memory of 1516	1596	63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe	83

C:\Users\Admin\AppData\Local\Temp\63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe
"C:\Users\Admin\AppData\Local\Temp\63956db3f0e10435881ee1a033154f136a7c9c48b52f83351903671f7353fcf2N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7F31.tmp

Filesize
29KB

MD5
991777419585864a3dffe1d00b2acaaf

SHA1
8b042a36c1078a394e770b4de0b2307797f52617

SHA256
7c3824d2c6e053746ce0dde0bbffac61011f2ea8467d2b35a90aa2292482f646

SHA512
cd11aa33e6ec13972af65d2f8a6e735601be03c418253d17cd31c16345683b6ca24a0ff76c294dfbdda96d81eee9e25a762c6cb45fc2953a2275c5789fb5966b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c81d21d2280eece1456bd3cad380bb47

SHA1
20d2f64d29dc862c3e4bb4690a6ed022ebd7487c

SHA256
724f4089cfdf0d2df31586c3f10ac816e38d0364e8ec54b2f9bfe2e6777d02fc

SHA512
ce83a1b7e4c7f9c437f0e89cc74960abd2543d9913b19cfc9594d1b7963677a29923f9c847b354e60c53feb0478ec8ca2b4334108aee327f87914e622979c785

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
53093e40f9fb2d8a953e2f3aa32aec98

SHA1
e6cffa028d4d5b266433013ab4371e42bc4b421f

SHA256
af83dffdd424b1cc3189b2b2003844c73912c05dc36f1a6fea7b4c348d8058c3

SHA512
96b2b68127cdb69381309d9ef8be47fbe8b2fdd7043be7484c8567307d7cb53e11ef0e3015df69ab25009b035b1ddb080ababf6ae54b573681c5a270d2696afe

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1516-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-128-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-124-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1596-127-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-123-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-134-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-156-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1596-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads