mydoom | 48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3

General

Target

48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe
Size

29KB
MD5

dcbbf4d9956b513732f5546174e3c6b0
SHA1

46afea355a534b4ad6f591ae7a420df51ee80805
SHA256

48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3
SHA512

d657c32b29f256aac4cfd50eec09504e99a11f476629fa22c845162864c05e96111a774066c57f41ef8c69fc1ef5f346722677373d336fdac5980ce3beceaefa
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/k:AEwVs+0jNDY1qi/qs

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral2/memory/4028-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4028-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4028-51-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4028-126-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
528	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4028-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c62-4.dat	upx
behavioral2/memory/528-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4028-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/528-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/528-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4028-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/528-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4028-51-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/528-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000000709-62.dat	upx
behavioral2/memory/4028-126-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/528-127-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe
File created	C:\Windows\java.exe	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe
File created	C:\Windows\services.exe	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 528	4028	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe	84
PID 4028 wrote to memory of 528	4028	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe	84
PID 4028 wrote to memory of 528	4028	48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe	84

C:\Users\Admin\AppData\Local\Temp\48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe
"C:\Users\Admin\AppData\Local\Temp\48ee9fb81399b3f0217ea04dfa31bf47c5ee466da73518dfc917a30bd7ae0fd3N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q8uxo.log

Filesize
320B

MD5
c2b2759bbd919d60ecfdf08419479043

SHA1
6a52283cc1cd7ebc53f738c819420b5f4eef5a1e

SHA256
5f7e711a1bfcc9a0ad0c93204f82289fd8212ec709fa92538d36c27cd6b2737a

SHA512
6acc4d5eec51d745227a3de7a27bf543308f06ec3a38b834781ab30af29a3fe78fe2d18e18ea2551a6b1e9f923613c2693910eb855ba127c661b4665801d95f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2831.tmp

Filesize
29KB

MD5
13b14f644390ac6eb0759872e46fa216

SHA1
70d401ee965dc9d065ce527d3db20e7535d7d8e0

SHA256
9dcd9676c92b99f396f4503482084a12373581df3abe11014f2ad0b7f7629361

SHA512
f8f3585018b5b913e02720eabe921d0d7cc7eb6548e65910c8da29db6a9c1b7244c6292846d1df20d76ed9e98544ad35e6b9222e77ff19a141f430cea0884b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
74f69d3ccd63fad1b459b57e3db9d0ff

SHA1
52f94dccfe6a9881a99d55516999c3e4b3f6a9b5

SHA256
069c4e59b1e9d54d8501b3b7096e55a1972362248098902e86124d52fb79ef97

SHA512
4fa29bf4d1ae13da298b3ca31640464892c6a5ab6ce8d52166dd7eaefd32de025ab148998c71eec8425606280c76c598a83ea6b9c1739d9037b527de549aa61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
6cd397566cff8e5dcb207ad36c94ef8a

SHA1
c2932062c028bd722a7e9269c9641d4f928425e0

SHA256
1ce405a9677ca53e86e76545549492d6325874c00c3da0c439c5b3d002e4f6b6

SHA512
01f86c944d9249d62de00d2d927a20e70859ccdfc93739bbebc125f6444f6fd26f706f5b7e63e2a94f4ad531e665c68748eb205b70eb5cd5649eecf7b671c378

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
368B

MD5
491cb2bcdf86fb54ba153ee29aa35e6b

SHA1
dfeec041032740606516d007f02650a87ca4c153

SHA256
7cfd559cab5d8db718d5889770e65f46259c30a717a978cf7ae34770dc14186f

SHA512
1721ff47a36d40b0bc7e36e4d2f67acd20b242577168579225e7287c10d258f231d43edf2db0c35a04bb36abe4c652293a054b0ef7e2a7360cfc435e5b519b99

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/528-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-127-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/528-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4028-51-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4028-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4028-126-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4028-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4028-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads