mydoom | 8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21

General

Target

8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
Size

29KB
MD5

5d1b707b4cc1e9a204a931b4d9221b91
SHA1

b8e7fa59075d5d6f0606bfd493a853cf98027241
SHA256

8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21
SHA512

c62f32aec03fcd5d94c53aba618b135e51e9008f29c39cafc8686c53b369fc5cd3020c44d81790b9c67f71b1303ccf20e13ab9f46e0848e72fcc453ef0cec045
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Vq:AEwVs+0jNDY1qi/qA

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/4636-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4636-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4636-93-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4636-152-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4636-156-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4636-163-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2728	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4636-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c9e-4.dat	upx
behavioral2/memory/2728-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4636-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4636-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d0000000218b4-48.dat	upx
behavioral2/memory/4636-93-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-94-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4636-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4636-156-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2728-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4636-163-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2728-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
File opened for modification	C:\Windows\java.exe	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
File created	C:\Windows\java.exe	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2728	4636	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe	83
PID 4636 wrote to memory of 2728	4636	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe	83
PID 4636 wrote to memory of 2728	4636	8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe	83

C:\Users\Admin\AppData\Local\Temp\8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe
"C:\Users\Admin\AppData\Local\Temp\8f91a5938f400a271e8de98a1095a1fadf6be11f7725ac6bfe39c0954a37dc21.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBFA4.tmp

Filesize
29KB

MD5
c86c41e539fdfe6ce79b20cf58d8b610

SHA1
441a58e51cb288880ca8027127e85e12cea38014

SHA256
5a60b3e160165ea5161181abc144fb64074ac74eb6bf08803f536d3e9f06c6c4

SHA512
1b0d9ab6d217875b0a3f3538ce4caad5ad4ddeb49f781e7e412e11bb5a4fc871b5fee8bf0fa97c8a5e2957c2e5dbf8089f12d7f59b436cc2e58c3678cc343fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
c58f2d2cc7ab04184486cc2b14330bd0

SHA1
5a63d8589a4731b5bf516d2a36228d07e9f9312b

SHA256
f6d8be2c60c754fd9d2cee59322046ea1477b0a47d972d96a7b5631cf6efe1a9

SHA512
db751044ed86b388872bbf5bb536446eb37da84759f4134283c94626f9831db2eec93324d4c34e61ca589a237ae1444866472cd7f1c429ae7c781598c04a2545

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
a73c9430bfaa59390ddb6ba67e435e4d

SHA1
f660d9d305ba43614a8f98fe43f812fc6b183ec4

SHA256
e422565b49d17be0da805be659eeae7f994ddb4c6fb54b2686994ace9ea4579e

SHA512
5470d8f343b9bb47f33ff9ae50ddc7b910e3adb3d345f9ddb2e003813d21ddf70968ec7881df1d5f4d5d7464c4649f05c79fbf635c74f0aabed032c61faa4fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
9aa6466e442f78de682f799ce72ba466

SHA1
85c2fdca82fc93293f1663011367094f6c134197

SHA256
73e8dfca15c0b6dbabec03e1250db9f10059060264c7e6c0267b1f448ae9f895

SHA512
ff9bfefa4dd187df9812fc9dfae7dacfb647766f84fc274d7b966e44f589e5157727b3d5a6f2cd66aa95a2a8bd342f39760f46c282c948c6f415e686c1dd8879

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2728-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-94-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-164-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2728-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4636-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-156-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-93-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-163-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4636-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads