mydoom | 0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe
Size

29KB
MD5

94cefdae1f33a137e90eb68c8558cf3c
SHA1

bb26cca71035850c67ff646adaba16054111216e
SHA256

0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877
SHA512

cda890594a9fd4ac5675bac1164adcf257280f190e2aa4fcb38f0d63752afc12e64d1f7f7ec3f82dd47df750cdb876da9fc92e0c83891dfcbaf4206569d6e06d
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/QhR:AEwVs+0jNDY1qi/qIr

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 9 IoCs

resource	yara_rule
behavioral2/memory/5072-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-155-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-171-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-178-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-213-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-258-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/5072-290-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4084	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5072-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023cad-4.dat	upx
behavioral2/memory/4084-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000900000001e786-50.dat	upx
behavioral2/memory/5072-155-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-171-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-172-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4084-174-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-178-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-179-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-213-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-217-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-258-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-259-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5072-290-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4084-291-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe
File created	C:\Windows\services.exe	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe
File opened for modification	C:\Windows\java.exe	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4084	5072	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe	83
PID 5072 wrote to memory of 4084	5072	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe	83
PID 5072 wrote to memory of 4084	5072	0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe	83

C:\Users\Admin\AppData\Local\Temp\0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe
"C:\Users\Admin\AppData\Local\Temp\0e83444a0a0cd8b6f5c8f692a72a4f87c2c806f2eda49138b02866498bd14877.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\KNTHSTLQ.htm

Filesize
162KB

MD5
aed3fcd3f2ac813ed5186a02dacfa42e

SHA1
9e779c69aa57a17787bfaea33126fc5a179cf25c

SHA256
7456db8e64a48776e72339b465cac87be176eff853432b9cd28bb537397bb8c3

SHA512
2f2130bac795f074acea79aedf4c40a6e87fb49b2d44c3b25006c88e3538d5af5ce88f5a10a1cd341258d0a2d91313b3d95be41f658f5bd3c00cb0f080227b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[1].htm

Filesize
311B

MD5
215c230635335623c6b1bf5b3b84ae0e

SHA1
a98de5bfab1eef2c02b4578e5d7fd3dcc1141481

SHA256
26b9da0ba2f737d0a226ab6d5b934b0e519aeda10f497cd4738752761ccb7af1

SHA512
5ddb80d7d4fd3d87865ea541098034cf216df76dc34bd41fca62f8c9a21218f1cac5d8a5554e2acc04a2b1ceaf839e5847d14c54f052c9eab43fec28936225da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[3].htm

Filesize
311B

MD5
cb42662caffe525e9957c942617edf06

SHA1
615009db9a1a242579e639ee0fc7a2a765095bfe

SHA256
312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15

SHA512
3e6777f1f74f64fff6cb2bd1a81a6c08d9a64feeebc3deb7cacb8f0f41b23a5c59a8e6294b99c76dd386aaaf9043a1a252ac47910fe1801bdc2995f7b675692c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\default[4].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\search[1].htm

Filesize
120KB

MD5
54b363dab30544cac7e23c14ce9548ed

SHA1
da99a438d9b1fee4c9036c8a3ea9e50be31d0e71

SHA256
22c606e6f1343878c6b06ebd69451f43cfd1d26225609be69dd9fa82f9b70359

SHA512
51e6b5cc6adf947e1cbf982a214e326f40afe6efe4f07c15a0ad687cc2738f416500916a26c9310d619c5efd1ba4bd77b99c33a821d814ee49c4f1ce5817b7a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\default[4].htm

Filesize
312B

MD5
e5c2364375c0a8a786a9508a840b6299

SHA1
bec1874db0d2348274b6656d1383e262f73e2bc6

SHA256
51b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3

SHA512
ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC88D.tmp

Filesize
29KB

MD5
8d8fe600debe052c853f997b4e07d3b0

SHA1
dec735a50e0747fba27f480929886e6883940ad1

SHA256
3720a5c238a0cde4db9e68f1b0f8b976445eb312b9fd07feafc5927a21500eba

SHA512
afd3b90250dd1aba0537d539022ff56c67fe549796508cb2f054321cb39561c34044541e2111539e0958ef41db3db9891c33464dfcd4d17e97c4f0cd89e901bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c770bc1a03ed0e73c23170b0138af432

SHA1
185e02965356a02b38b0330e9b707138f697a8c4

SHA256
6f2b731e80788dfc061be8cbc44004a5a86fff37322589bdf6d616cb6905db12

SHA512
e7af65628825300b01c976b2ada9b54a0b1349a85b03d09a4eff82698e157c2c9d8754c0d74a63aa1f5ba9be9c52be00246ef8a8f2c71efbb085e2a78d82ae10

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c55a8b67a54f246d2c52bcb2f494074c

SHA1
962a872564ef89a29bea2a13b89b5d2c3cddc5cd

SHA256
de2d0abf793300d6a59608260895407c017e5ef9e1dfe28d83c12467d8388c23

SHA512
a1268974805e24219faf4758c754fef258be6baec7a903a9a57231f55c8ade35660cc6d5890ad6b7fdbbbada1479b713b4599f3d447571b8ea25f84936875245

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
01b03d5cdca7ee1c50830ddde74ec7bb

SHA1
be09a9cfad2fcb92cf3875bf5c8830ae23c29d08

SHA256
7ea39288dc806b254e3ea29c3f8ca3426b3164573afa4f9ce5520d208cbc6f8b

SHA512
0a7ca47465cacea3f950a37a036364588143b635162a2d23a4d26936390e922147d85e3b4b1fb9dcc3a64cafe840c7a0b02c45b4547092ca75b4e205d8f6e8d7

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4084-174-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-259-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-291-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-172-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-179-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4084-217-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5072-213-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-258-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-178-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-171-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-290-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-155-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5072-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads