mydoom | 3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082

General

Target

3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
Size

29KB
MD5

65d3a21032b47693cfe0ccb447947250
SHA1

ec66c5d2017cb92b519a6a38912e41590f8f998a
SHA256

3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082
SHA512

74df15d5015f1c4f484c7743926614e4ae4c0e9c239e0c2dcb053ae6e393055c3dcb4ced1317a84e66e2805f9be7ff537c93deb5b5f3261192d118a5520b0221
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ub:AEwVs+0jNDY1qi/qy

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral1/memory/1984-17-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-38-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-43-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-59-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-63-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-68-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-70-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1984-75-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2352	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/files/0x00070000000186f8-6.dat	upx
behavioral1/memory/2352-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1984-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2352-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2352-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2352-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2352-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2352-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-38-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-43-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-54.dat	upx
behavioral1/memory/1984-59-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-63-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-68-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-70-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1984-75-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2352-76-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
File opened for modification	C:\Windows\java.exe	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
File created	C:\Windows\java.exe	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2352	1984	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe	30
PID 1984 wrote to memory of 2352	1984	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe	30
PID 1984 wrote to memory of 2352	1984	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe	30
PID 1984 wrote to memory of 2352	1984	3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe	30

C:\Users\Admin\AppData\Local\Temp\3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe
"C:\Users\Admin\AppData\Local\Temp\3087b10a095df50b0219749723939a8838eab9e8884bb078dadc44b75097b082N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n5sBnguk.log

Filesize
320B

MD5
754b21241ba93074e01aa4d6960a8cd2

SHA1
abfb456eb2289801e6d177ea2b905c10c02453c2

SHA256
5f720c206511e454dd2b63c352883f31b42b5df1cea6eb24b8259675b527e152

SHA512
3aa2af3753dd4845f2def0c361d929ffc4493e7dc93760a293a41f14f3775e6d653d05ba12bb82eb55dc425c8a9e0fb6ba6c4ffebf9183b0c56faf353cded4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp95AD.tmp

Filesize
29KB

MD5
d1742632073fe9c12229c0bab44e0f5c

SHA1
04c1fd23fd98df82eebb9e42a288cd9ad4c55000

SHA256
9fb11aeec9cc61852e43f0e3de6566f7293972c659ea410044f5fffcc84b411b

SHA512
417f6c9e89e9583efe247e4d7172dcec6bf81daa643bf8f3eb7a6f51dd4a617520d3a0c76af5b233ddd8dcad8956c4a4b120e90e478496f6749ea9fe233f810f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
66b2588402bdbe71f779fea479458cd2

SHA1
e96321d50230e2a21e58af5f4d2f642246ed15f9

SHA256
ffd3eb0dc58e97a4352de67674fd47d5e8d81c196c2cfec581136b5caa7347d6

SHA512
c27f5adac6800d97529f8464ec8a155cfbff072cf7cbae6eac685e716f9807d8b10e324a04a614d57a04ed49e1bdb0edfebb2b8f802be59c4aa3ef7e5d92b441

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1984-38-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1984-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1984-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1984-75-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-70-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-68-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-63-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-59-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-43-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1984-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2352-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads