mydoom | 137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe
Size

29KB
MD5

12004c82bfa7d0a9db4daf5b795a3170
SHA1

0f7dc0864295062663a6dfea4a2aa02851c46b04
SHA256

137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0
SHA512

5b8e710cb700d40d68719d8a361200e3158a4c262309a9abce7c40388cd1d6a6c124d9cb667da57e011033b7f2c136ff1d27fa97d6cbc20bcb2c0359e7f6ed22
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/QhQ:AEwVs+0jNDY1qi/q4m

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/3220-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-123-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-154-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-158-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-163-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-179-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3220-219-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3696	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3220-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b91-3.dat	upx
behavioral2/memory/3696-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3696-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3696-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3696-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3696-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d000000023a98-43.dat	upx
behavioral2/memory/3220-123-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-124-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-154-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-155-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-158-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-163-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-179-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-180-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3220-219-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3696-222-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe
File opened for modification	C:\Windows\java.exe	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe
File created	C:\Windows\java.exe	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3696	3220	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe	83
PID 3220 wrote to memory of 3696	3220	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe	83
PID 3220 wrote to memory of 3696	3220	137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe	83

C:\Users\Admin\AppData\Local\Temp\137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\137a25cbc69b4d944696e812f82fd219a1ba7ae351b6aec493ef860d81380cb0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMGLWGAG\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\default[1].htm

Filesize
312B

MD5
e5c2364375c0a8a786a9508a840b6299

SHA1
bec1874db0d2348274b6656d1383e262f73e2bc6

SHA256
51b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3

SHA512
ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp55ED.tmp

Filesize
29KB

MD5
186f79a91c7aa3dee126241f2dca98fb

SHA1
123db21b054f2943f32e8ebec9af03ab5c404dc9

SHA256
49bd8604fec8d7de1099155ccba8657ca3f33c3248f7d1add15fa9a094313f4d

SHA512
9b2cace6735fa5b78ad14238a3beae4000326c19a38538e5a9d1773ae900cdd1de5f991c255275561f55f2ac94885b394ea10b15731518cce403e0791b06eb92

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56FF.tmp

Filesize
29KB

MD5
2d12f048c0c077904982f651cfd3daef

SHA1
34b8896cda9b8da49e9f990fd060fd736772e000

SHA256
59f08db3e6fddec7e19603eff4bfd062fb496b9e9c4cf9b1343e9b5bd17f370b

SHA512
ff9c03936fe95125b08d2b89771b15543da9f75801ffbd6458c98ac7455a85d4029a91ad257052d2634b1092366f703724852067103700731a8fb578bcce5c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp57DF.tmp

Filesize
29KB

MD5
868dd9cba7cae53f2b596d2c76943294

SHA1
44004e81cfb88b31cc07268133a2632f412683dd

SHA256
f8311fa9d946261943b1a9e879b10b061db93a91f59d4a931f15e248646cf14e

SHA512
9fc6cc754051774f74b7cb8173cd7916f0d288e58435c393567130440b13445757f7acea15cabfe610cdc15def17906e4b859c36fee818e8147f1a1c85a6c001

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
33f86375c2c9a6c4b51d2ffded8e58ac

SHA1
79c3e4ca8ded5142d99d42ec5238210f87e89634

SHA256
b00879c41f3c090ac8ee03510476e4ee133d1c99183f92a77003071ba5aedcb2

SHA512
2573628d3b738665e40ffe358d2bd2ced92bbf5961f2776d8105da120c490b39ea7d19aa5ede9d514a5b9a7de45c758cd67e180951ed36b81b9b666e500908ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
2960bd1ea3501105224e43542cc7c44f

SHA1
c8fcadc3e0995ef2de91dd3c2db6e624708dc3ae

SHA256
f8d3890fc64b35862c47a9461d2a9965242669a37999d23cd45e889327fd9028

SHA512
935e91a49fd49cce4cf5e0880c2fcffc860cc78d86277af616727b2f75be2c48e6e752bce5a4a441399c28bf81c4df26fa95538dcb108446347c4f9ef27b6594

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
caa87743ef81e33416c6cdbd8ba86352

SHA1
3cb7e3d804b7aef4d1447406e9ed6e483c76d8cc

SHA256
81a0d7965a073a4609b3668d146bbcfe288ab6e2721897528b5151d76f8011a8

SHA512
b8348472dd64b75dab409aec7b5627941080dfdac17dcb3c31ae628df4a31227892bd4a857a554e4c92c5e67f140413f37a1b8f0371b11ac03168be68eaa5a29

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3220-163-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-154-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-219-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-179-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-123-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3220-158-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3696-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-155-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-124-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-164-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-180-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3696-222-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads