mydoom | 78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28

General

Target

78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
Size

29KB
MD5

65926ec91d35ba5b3955dba47f398d00
SHA1

4667c307c3f637b8f068707a34fb5b6b57a3dbef
SHA256

78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28
SHA512

4170f5827cf414214951dc018cfb46868da0de5a83f975b5a35c733db5c5cd0d5584833373fb41fc4f6783e940d47f69ec8a8ed406608852ee2e4e2c4b31119c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/AhD:AEwVs+0jNDY1qi/qYR

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral1/memory/2100-17-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2100-53-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2100-55-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2100-79-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2360	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2100-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x00070000000186e7-7.dat	upx
behavioral1/memory/2100-9-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2100-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2360-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2360-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2100-53-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2360-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2100-55-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2360-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0007000000018704-66.dat	upx
behavioral1/memory/2100-79-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2360-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
File opened for modification	C:\Windows\java.exe	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
File created	C:\Windows\java.exe	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2360	2100	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe	30
PID 2100 wrote to memory of 2360	2100	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe	30
PID 2100 wrote to memory of 2360	2100	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe	30
PID 2100 wrote to memory of 2360	2100	78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe	30

C:\Users\Admin\AppData\Local\Temp\78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe
"C:\Users\Admin\AppData\Local\Temp\78d6c957a77704aac19f538310c8d5311ce1ce70cbc3401eedc17c7c831fee28.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4E41.tmp

Filesize
29KB

MD5
209b990aaf6f6d28e49c8d7a3e75a1ec

SHA1
685348ed84c879a511752a675ee814ecd83fc506

SHA256
5d94cd575673556b1920db331a483e9a023df56e0108136c23e0ac4a57834475

SHA512
4e39721fc21765e6b06509b688199e7837dc357caeb8130015424c5c42b672f55beff4b965e44b56583b524413ab45dca18ba2c6cd7ac134206c02d4db4b2b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
61c6bec22c78c455ad77d0c1ef81e9d3

SHA1
2a1b55a6a163b0c079754a030fb2b0be188f709c

SHA256
c08772b361b67840897b73348daf24e97b184b6f25bd2b17881e0ac799edc7c2

SHA512
6d042ee77b1cd6584f0509d5c505f0beff85c1c9cd1756da61a34cbc378ebb34ed908d4262e6f32393fd95571904d28a4dd2a2ffca220c55dd1c9924ad534609

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2100-55-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2100-53-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2100-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2100-79-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2100-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2100-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2100-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2360-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2360-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads