mydoom | 01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8

General

Target

01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
Size

29KB
MD5

b0f6bc04419a03e3de5ee4cdacefb770
SHA1

c42a6c35b02216ddf4a2d105df91f97911b25bce
SHA256

01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8
SHA512

0d4b16a14c2f345aa264d2fb5d8b6b99335dd09ca053bc2a997ef59b2f675396cbe646e59928a2a78aeca75c2dafc843aa699b0bfcd59d171e79a8e0d64d5f35
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Jh3:AEwVs+0jNDY1qi/qhV

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/3836-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-27-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-139-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-155-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-164-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-198-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3836-229-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1516	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3836-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000c000000023b84-4.dat	upx
behavioral2/memory/1516-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c000000023ba3-46.dat	upx
behavioral2/memory/3836-139-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-140-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-155-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1516-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-164-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-198-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-199-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3836-229-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1516-235-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
File opened for modification	C:\Windows\java.exe	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
File created	C:\Windows\java.exe	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1516	3836	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe	82
PID 3836 wrote to memory of 1516	3836	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe	82
PID 3836 wrote to memory of 1516	3836	01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe	82

C:\Users\Admin\AppData\Local\Temp\01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe
"C:\Users\Admin\AppData\Local\Temp\01c6852ab7a3677371f2b089ecfaf84bf1b20de850587d211f9849bc621adba8N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IQ93NPJ1\default[2].htm

Filesize
313B

MD5
ffb72ab4faba49ad441ce07db37dd8b6

SHA1
194e13c1c32ebb6e7a1dc912261cbd58a82ff71e

SHA256
7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660

SHA512
517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZA7RG4JF\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2941.tmp

Filesize
29KB

MD5
62aaacb4f8b5a0f2e98f50ffc007a149

SHA1
f4cfa7320985c7c0e307d5b6cd3d42722e1dbe5a

SHA256
ba2f4a3e1606020d0a633f9e1bc49bedbc25bb701c02a3dadc926ee94d7ac355

SHA512
76a02b2072834e93572bde98a2be94c16e6d6d729a131b5ceb88f3ef355ebb13eed83a76afbf2910a15a97afe32267129a31a362820f48fd78f80d5f4a40a55f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
57f69b062dd8ee626f558f9c5d3babf5

SHA1
8a26ffab0e96c7e0fd7e2250472d2529c458a187

SHA256
9b7119bcecf7689d3b3d9e2b3b8bb6d5b569521e752a57edfb8242e73bde52cc

SHA512
4587058da02c1e75a2d345287957a5b7130fed9febe39f51bc10918306ee9522bcf3d37ee58d50bc579378dbfd27768838ca5beb4d96928abfaaddfc814223c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
4c1a269bd7f554f6cb5345abe0e8fc5c

SHA1
ab8b59df019b56507ac91134a03d0c3fd66570fa

SHA256
40ce3c15d6a781ba41074bce953fde32fbecdd31de82fbed1fa9cdcde513b50d

SHA512
4109a028980139f9dedc88d3464ef63ce0f4959b4677373aa884617d1f33fe9fb7ad91b719041a4417c1d9a66a6efd4add1d356400a8b57999af1ef81e59cad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
beb4aa166e988b8da5678fd75accda97

SHA1
1542b5bc54ecd98bdfe93b31c7e4ac64c7d925fd

SHA256
ae7b79537770cf0fa20b82c2e18d56046034f5436fb8b952750c6111b38467ad

SHA512
730a5d5f11baab3e33361c56d19ff263c97dc5670d5ae8e448f32f563b12d2d89cde7eda844711533aaaf5fd0953986af6bdbb532d22728be47d478c8b465708

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1516-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-235-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-199-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-140-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-156-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1516-160-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3836-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-164-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-155-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-198-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-139-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-229-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3836-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads