mydoom | 7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4

General

Target

7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe
Size

29KB
MD5

8fe1b19b6f15363bd1360ef8d243bd70
SHA1

f1a797adb62788f6c73f61d1f84fa64089b88427
SHA256

7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4
SHA512

a0014d57b959a5d335f7ed293e4b2280bc84009c4e45cebf59ce500f2b9f43ef4adee953a35fad0bf69df3a17b8db7a77cf0a1ca48468284b617ad33c31d07ba
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/rm:AEwVs+0jNDY1qi/qC

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral2/memory/3248-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3248-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3248-103-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3248-144-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3248-148-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3420	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3248-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b78-4.dat	upx
behavioral2/memory/3420-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3248-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3420-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3248-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3420-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000021ea9-55.dat	upx
behavioral2/memory/3248-103-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3420-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3248-144-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3420-145-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3248-148-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3420-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe
File created	C:\Windows\services.exe	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe
File opened for modification	C:\Windows\java.exe	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3420	3248	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe	85
PID 3248 wrote to memory of 3420	3248	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe	85
PID 3248 wrote to memory of 3420	3248	7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe	85

C:\Users\Admin\AppData\Local\Temp\7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe
"C:\Users\Admin\AppData\Local\Temp\7cc14c28c111dc17e309259e64ce2880dce4fa92b55549734157391adb8abec4N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD454.tmp

Filesize
29KB

MD5
e47e04e7aba234029a405054c6badd1b

SHA1
09d36686be1c63491eb681ed13de1da23f613182

SHA256
d5675520ab5bb7197ccda86341af762a9b5ba38296758b04adc8a544e18d8765

SHA512
2d523f6a7939fc071865314b52708073b8d08d8e4d9d9b5675a61334c82255355cb62802549f6e61a25cf9a208d7c77ab73bdf1586e7cb5ade3e0669a55258ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD5E3.tmp

Filesize
29KB

MD5
9de94e5e37c4c83c2500377ab07d2a46

SHA1
ec586c519c4fc781088f2ca2803ea35d4ea1d6a7

SHA256
f85aebbe186b1e7acef17e4545af3b50d127e01e2734e07ef2ffead64cc0530b

SHA512
61c1669900805c7c2151f2e1cce8368f23c10f79dda8d6eb2c54f61749ee46a468be3855cd10cc720b07e4a2baba1b80bf9dc8fe60166a240fc136cc116a1155

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
cac67e667d64e5fb1fa10876250def6d

SHA1
d08190056b867a0d1e954676c5bbc1ac5f670830

SHA256
31f0e9f9b4bf5a1b95d7ace555d1e6ccba04293fd9028e71e9e5a2f73e593026

SHA512
fa4036749bfbdb673f982d044ca7f783f0b7a3e8409584e4a54f93717f3866e4d08c415b046aeea348ec53011df50979ae48d12be82e13fb6f24db6e22fb6d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
384B

MD5
2562ac1e0e8e880a90936c2702f24d3a

SHA1
47ee5315f110ce8388a4609d5155677c9d80898d

SHA256
5b90eee73033f2b979fa29ae2bd3ac18114c720b72ab69f74aa13b62dc08df1a

SHA512
430ada23f0d969b6030f5f0b0a3638fd54593d01bc603569f5d1a6c1f2aa88c25c591c397b9a0cff890e6f10b047e0999e9f79075b6d069400021d57fdd81626

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3248-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3248-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3248-103-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3248-144-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3248-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3248-148-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3420-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-145-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3420-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads