mydoom | 912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487

General

Target

912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe
Size

29KB
MD5

f6b9d4942a9cc75f1a4df9871991aa90
SHA1

63dbd95769908f6d9d536ed84359167bee67fc8e
SHA256

912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487
SHA512

9c0482df28fcdcb5711affc609b784855055af485cc4b1a626859a3357030eebd7d8ba99d90a164b74ee8271488a4c3dd9901c7cf4c77b79694d9bb6c4ae8048
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/e:AEwVs+0jNDY1qi/q2

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 9 IoCs

resource	yara_rule
behavioral2/memory/4836-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-27-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-140-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-150-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-159-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-192-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-225-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4836-261-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2792	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000d000000023b80-4.dat	upx
behavioral2/memory/2792-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2792-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2792-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2792-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000500000001e742-44.dat	upx
behavioral2/memory/4836-140-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-141-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-150-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2792-155-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-159-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-192-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-193-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-225-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2792-226-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4836-261-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe
File opened for modification	C:\Windows\java.exe	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe
File created	C:\Windows\java.exe	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2792	4836	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe	84
PID 4836 wrote to memory of 2792	4836	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe	84
PID 4836 wrote to memory of 2792	4836	912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe	84

C:\Users\Admin\AppData\Local\Temp\912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe
"C:\Users\Admin\AppData\Local\Temp\912ea9b3953bcbc3f87d2506950b3cce8af869c94c11957c9bd53c39a494b487N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L6PPXFHA\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\default[9].htm

Filesize
311B

MD5
cb42662caffe525e9957c942617edf06

SHA1
615009db9a1a242579e639ee0fc7a2a765095bfe

SHA256
312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15

SHA512
3e6777f1f74f64fff6cb2bd1a81a6c08d9a64feeebc3deb7cacb8f0f41b23a5c59a8e6294b99c76dd386aaaf9043a1a252ac47910fe1801bdc2995f7b675692c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8133.tmp

Filesize
29KB

MD5
bc236cc0ce5714145bfe1d4f584aef87

SHA1
776707911df04898cbc28e0f23fedda9b12babc0

SHA256
02eb6bfa9075714491b46c0985ff0f8eaa42b2853174b83073c24ef77fcf7d45

SHA512
24349b76447faca7ed797bbc2f370cf23dfdadc72168d1e422a74f8c547a46d730b0fde19cb01dcde87a5efc61a9e0eae44b24608c032bafaf19eadf300d7084

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
d9c66b0245c0d929f5557a0b08ea5a34

SHA1
7452f6de6f5b994f765a455d9c081d925fd7e28f

SHA256
1feca392c40c3b1809136af862086f8fa894bdc70e0ed4d50a5a655fa1d59490

SHA512
019fd767b618086ee05d8eed45bebd7ecce54a99106b38d382dae71a05302b87bf7f02b17590e0b2e7c8d387c276e4e018925cf7909dc7fd320c809a97f27250

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
0ccf9a686e884a137f76dc5cd9e2e80c

SHA1
fc3a13bfeec320ab96e64f46caa63661f077a21e

SHA256
6035ef7b36aa1807aba0a1937045f130d9378310b28f7b85ac36ac4aad060d43

SHA512
74a769e9adfff8d387fe11735fa5022fdd7815de0567babb963d72bbd5dbfdd598a75c2493a9d8b44353b4e37460fb6dfc51bf07febb102cced2325713651860

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
711629645138d55572e40c9a71e967ee

SHA1
06fdc5011feaa5eac078061c1ba646cae0be3ced

SHA256
1460ffdeea9714919eac7723f51ff60d9ab5e5c37a3fb7df636f9d3dc07f82bd

SHA512
46244e8d90d3f58f1cc5521f699bbab2dd08c1c5122da26be41078f26f52daab1b299bf5fd21fe17b652995f915aed55c047fe7da81e0c258a9df1f05aa74a1a

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2792-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-226-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-193-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-141-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-155-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4836-159-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-150-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-140-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-192-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-225-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4836-261-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads