mydoom | 37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e

General

Target

37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe
Size

29KB
MD5

f143c07a59160ef7d637b1d8848f22a5
SHA1

798193ed689cd4e40c9cc95551b521656687f36f
SHA256

37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e
SHA512

a92515a7c670b1045714fc2efd0f99747805647b4cc398665901a5c246aa16eba1f74b7051c2058c1d229c73a3c7b32a1f4a6d30e6fc372ca37df10c668c66ef
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/whz:AEwVs+0jNDY1qi/qIB

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/2768-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2768-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2768-123-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2768-160-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2768-166-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2768-186-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2800	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2768-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000023c92-4.dat	upx
behavioral2/memory/2800-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2768-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2800-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2768-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2800-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000705-60.dat	upx
behavioral2/memory/2800-124-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2768-123-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2768-160-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2800-161-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2800-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2768-166-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2800-167-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2768-186-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2800-187-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe
File created	C:\Windows\services.exe	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe
File opened for modification	C:\Windows\java.exe	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2800	2768	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe	83
PID 2768 wrote to memory of 2800	2768	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe	83
PID 2768 wrote to memory of 2800	2768	37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe	83

C:\Users\Admin\AppData\Local\Temp\37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe
"C:\Users\Admin\AppData\Local\Temp\37064ff96cf1134970e9415a4cc5b4406d7120646a7f6917fbe149eb81f70b8e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3AB0.tmp

Filesize
29KB

MD5
00250b151c07f7e6b3c82893d2a7fe51

SHA1
9033df612fd0a8c4e0f7ee7508226405a6e0f8d2

SHA256
6a8e75011ab3dda9b67470794bb2ff124985c42392c38d8c1d54971da43ef4b8

SHA512
f4558b6a3505c9d82cffeb1c2a74c234535887d70b6e0dc91509ef8e7826f8d0382f88085a9f70a8731917fe68f29a26ca0aa9d7e840b985a08374b5bb0374dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3AC0.tmp

Filesize
29KB

MD5
e04352ae2fc8f6d2cf54b5c01919d2d8

SHA1
790bc5b1848b34784db6fcb8f4c3594c87b5e766

SHA256
4464e6017b946d74b4bff0de1a28310ce18c1c941d2e800ac973b7ecb0916089

SHA512
2168bc31ee164f0bcfa12e8ebeffa8ad38455f19c2c12b7fc3e1e12384feb85f34befe9c3246f94f26448c313b64106ff453e8b516fbe0f2aaae87392bcc5eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
81b27a6c43ca46d651175245d3b2bbce

SHA1
7d98aaf15c5c1c25fd3d4cbfb73c0cf0151ad5b0

SHA256
a938a95b6dd65a005f57c7bd591febea00159d94204a349589e6b5c8a1b0d035

SHA512
24e09f80fc4aba64e59e6f1c28fe22c6f643cb78733e2897fcca488c8a7642423c87a74a0de8680d864f1c4731302c6e934ee68cab516b4351dac79598af7748

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
5fc6d14e9cca6ca0550f92ae7415c327

SHA1
02a70513477b02882b72f91603c7da53d13edee0

SHA256
27e1299c2e31a854d20c1064fe769ef6671ec021466b38e48d517b7ea2778f5a

SHA512
5abf2d20298e45f9ad1bc5721b2202cd674be4255ba74ace1b58c82bd7f31bee00459f6e63e3b8ee6371bb6dcbbc904201207d33b106351b7508ccfccf9a8fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
be2d95fee4a05961a799ce873297a6a5

SHA1
2f1d18c74fd30ad16e51bd5172cfcf35f4fbe09b

SHA256
24a2f980bfc4f62d0bafdabcfdc1cb7ca0cda836734aa4f7c08305d7c65bba71

SHA512
336c9cdde3f07c79ac2757ba1e3daa7f33eafceaaf4180249e0f2233eb0944cc02b810aa690b18a48772bf9241d91b1b0a85af590c1f757991bdadc31cf45f56

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2768-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-123-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-186-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-166-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-160-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2768-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2800-124-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-161-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-167-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2800-187-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads