mydoom | d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede

General

Target

d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
Size

29KB
MD5

e1738cbb839c8a07da5d2c44d5214564
SHA1

899de89500f847ba50af0580a4db9e7254496d29
SHA256

d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede
SHA512

1e3d2ef284aafa00783da520de7c9bc78f315062cfbfade0087e4a1aec08c101e34e4ead43c029881b6223d7e6aa785d67ac46b3660c04ace7d234b302438646
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/H26:AEwVs+0jNDY1qi/q/Z

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral1/memory/2380-16-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2380-48-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2380-72-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2380-76-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2096	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/files/0x0008000000016276-10.dat	upx
behavioral1/memory/2380-9-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2380-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2380-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2096-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2380-48-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2096-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2096-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-59.dat	upx
behavioral1/memory/2380-72-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2096-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2380-76-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2096-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
File opened for modification	C:\Windows\java.exe	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
File created	C:\Windows\java.exe	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2096	2380	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe	31
PID 2380 wrote to memory of 2096	2380	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe	31
PID 2380 wrote to memory of 2096	2380	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe	31
PID 2380 wrote to memory of 2096	2380	d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe	31

C:\Users\Admin\AppData\Local\Temp\d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe
"C:\Users\Admin\AppData\Local\Temp\d739d75aa041b33f24f77ddf7978857e902d0ddec2dfe4763f5d68cff4673ede.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4569.tmp

Filesize
29KB

MD5
9327c39ce76a11420d4a6d06f012b07b

SHA1
177dd8beb2369c94ea2a09fcbda7005e1231db10

SHA256
d90318b853ec5108cf239cb53e9f234aaf4630854e686e5afaa835bf2ca94fee

SHA512
e61d1136ff07d982b296fe2244485e45e14b67eb6ba1c2014a60246c2931ad94154296b7beffcc03d0464de91e40db246c571f158db840e3710021004d794991

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
c414d69f0a64e4186b09595d9384fdcf

SHA1
488f48c238730ca71cec10a6e5c114dbfa37825e

SHA256
a7041feb718a7c70a7de991e2f0343ff18ad3a43154629ecc051c70ff6a47ec8

SHA512
8f2de7000c73ed4d91081fb139ec1eb6e4e462062645a6041deea7f1ce788b60076dcc60e755a73f530bfb3198f88ef988476f1a426496ce28abc962eb768da8

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2096-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2096-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2380-48-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2380-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2380-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2380-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2380-72-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2380-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2380-76-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2380-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads