mydoom | 8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706

General

Target

8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
Size

29KB
MD5

1d522725bac2f853460260a277d4fa18
SHA1

e50b8a1e33d7e848e365dd6fc5d27dcab8af6ac0
SHA256

8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706
SHA512

225b93df2fd3857cd29f0e25154dc016e7ba56320b8679251a1ea340e97e5093dc01b5abd77eb14fa4c1c3ed884e23538726cc1c1fcf4c4b609ecabe5e5165b1
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Gh9:AEwVs+0jNDY1qi/qu7

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral2/memory/4676-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4676-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4676-148-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4676-195-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4676-200-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3508	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4676-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000d000000023b49-4.dat	upx
behavioral2/memory/3508-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4676-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3508-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4676-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000900000001e786-55.dat	upx
behavioral2/memory/4676-148-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4676-195-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-196-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4676-200-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3508-201-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
File opened for modification	C:\Windows\java.exe	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
File created	C:\Windows\java.exe	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3508	4676	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe	83
PID 4676 wrote to memory of 3508	4676	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe	83
PID 4676 wrote to memory of 3508	4676	8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe	83

C:\Users\Admin\AppData\Local\Temp\8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe
"C:\Users\Admin\AppData\Local\Temp\8579b9eeea0f62d42b8977da823c5d4f7a0dd476a3c42e9e0788f02022e4d706.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\R9S7SJGN.htm

Filesize
153KB

MD5
809cb84a7783da018b5e7221791e8eef

SHA1
381280b5f8debe8128acfd2a8302023695c47bf1

SHA256
9eb7cab4671af88948d06497aea90d049fe62f8bb0b98a2957d726fd54aceb78

SHA512
3eb6358c8460bb77d8a97ff9f49bc73030da8ecd0314b0a6a94447f12cb770aa018090624984ad7831c74166c2f493f198d1a3b99dd2e01be2584cb1ef354a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\search[1].htm

Filesize
139KB

MD5
c09c95d3490c1191c626a78ffb852360

SHA1
991444401590f555efd2f96ab3ee8296705d61d9

SHA256
a78644a712de79e8e152c6ca76f3638ce6c7bc8ce36aeba37af424ebf7479880

SHA512
ef57cb69d59c9d6c2860cc963da7bde2ef4f7e623507e2cbcd9a5fdb0f49e2e168be5795a2451ea33ac254bd6934b61e682cdfae531f06602021c14934e76e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE4CF.tmp

Filesize
29KB

MD5
bff36afea2d1b9398d7f3e63fbd73cd9

SHA1
90b827cba1e709e8b0f8b638d121e674613fb82d

SHA256
2bd19910510126bd85adabe286c18229c5da061f1a19eba5e56b30580e068774

SHA512
d3f21c57f02d5040cfcb56e03a5fd6950d4787dd31a28d23d58844a92636120a6c9dac54ca9f49fb15161ee07dd948ea1b5c6f6dcdc93173c637d581cd768ef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
b21206a7afca463fd59b5341fcf77d16

SHA1
5ffbdec1988c87ef462bf52ffba4fd7badf393c7

SHA256
e0c99253c369d25e72813ccb5aaeb7ffdc3a7b07b1514e1c75c73b5edc83ee88

SHA512
2093ebdb8629d4bbbe6829d760e37ec40dbcd230ebd3f7b40bc6a869357638abdea98e50b4a56190982b52b29fcea49679fb3a06a04b8cd5279eab767b176cfe

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3508-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-201-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-196-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3508-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4676-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4676-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4676-195-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4676-148-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4676-200-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4676-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads