mydoom | 0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298

General

Target

0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe
Size

29KB
MD5

1d6d6d2bf2e6f25069ff0d5643189a50
SHA1

8ab59a70eb0b24cc28b09eb8bf7c917b80ff7fbf
SHA256

0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298
SHA512

43f8c0810e1988ae585e9c9a44f923a48c5774792aa93dcad96b4ab60803e908fe393de69f1248887dcc881fb2a6e26e43381b76f6b83f531750214e992a805f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/b:AEwVs+0jNDY1qi/qT

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 2 IoCs

resource	yara_rule
behavioral2/memory/1980-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1980-56-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4088	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1980-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c8e-4.dat	upx
behavioral2/memory/4088-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1980-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4088-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4088-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1980-56-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4088-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000000709-62.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe
File opened for modification	C:\Windows\java.exe	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe
File created	C:\Windows\java.exe	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4088	1980	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe	83
PID 1980 wrote to memory of 4088	1980	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe	83
PID 1980 wrote to memory of 4088	1980	0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe	83

C:\Users\Admin\AppData\Local\Temp\0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe
"C:\Users\Admin\AppData\Local\Temp\0b2d7261634f2913449e6645de6eb7086e15fbd7b8feb5b22c1ea3907de89298N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp528B.tmp

Filesize
29KB

MD5
c7dda4b87e1c3ed8ac0a8f269d5ac6ee

SHA1
20b863d9e9aca99e1527a076e1ea9ff668a1dff3

SHA256
a9a42c822a23519d9daef445e321e39ffbff7b512d53ea7324719ec7cf61264a

SHA512
68c22535226270a16272be04e8e9d4b54770b51d41f281e80c2bb98ca03252e374d09f8cf59325152be2044ab10a41d77c0855ed2d1c9c2177f3f0d0c8ab2b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
da45003a1f6d165dd308001156600406

SHA1
211dd1ecbd4fe7d4730af22dd6b43b69fa3dde55

SHA256
2bc064afb3e52d31edabd8c8f23ac6fe99817d0ae6b34d58364ab470d797fc6a

SHA512
7b657bf3e2e633d73a386454c44bd94f11139ee90f1f8282b8274fb5e7f9cadef2186f22b93be9f5c7b362dac1777bcd91f92b7380ac5accce14fab9678263de

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
48bf99fd7c68b7bc71320f05575142f8

SHA1
f3cdb8b252845edb6d636f41f0d21566c3f6c102

SHA256
b6fc7be996716baa56cb6575779f266ee76aa90ccfef7730ce51fad8673612bf

SHA512
373d52fecf14543d6fec7d90516a6893573da2e7f965271b4a8fb93c54d3d75f66cdc767061361c4ab790b8fc4cd2dfbe6deef0d2ca4c7d5f7d3c3b3eb4a5be5

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1980-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1980-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1980-56-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4088-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4088-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads