mydoom | 34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8ab

General

Target

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
Size

29KB
MD5

4cbe9734815d74e5a5c7a32ab762db70
SHA1

58b163bc93c7317d3f00006415ea6892e64f66e3
SHA256

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8ab
SHA512

1ec89a943703da3b01851ccf1b70ce2a664249eacf9924340e3f2b53f90b158d9601d58ec0f13da8d0ebb3df7d6b18fa402638f16bb8ab9e50f7c61ebb2edf4d
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ghv:AEwVs+0jNDY1qi/qoZ

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 2 IoCs

resource	yara_rule
behavioral1/memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2524	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2120-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/memory/2524-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000016edb-9.dat	upx
behavioral1/memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2524-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2524-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2524-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000017403-71.dat	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
File opened for modification	C:\Windows\java.exe	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
File created	C:\Windows\java.exe	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2524	2120	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe	30
PID 2120 wrote to memory of 2524	2120	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe	30
PID 2120 wrote to memory of 2524	2120	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe	30
PID 2120 wrote to memory of 2524	2120	34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe	30

C:\Users\Admin\AppData\Local\Temp\34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe
"C:\Users\Admin\AppData\Local\Temp\34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2524

Network

DNS

alumni.caltech.edu

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

Remote address:

8.8.8.8:53

Request

alumni.caltech.edu

IN MX

Response

alumni.caltech.edu

IN MX

alumni-caltech-edumail protectionoutlookcom
DNS

alumni-caltech-edu.mail.protection.outlook.com

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

Remote address:

8.8.8.8:53

Request

alumni-caltech-edu.mail.protection.outlook.com

IN A

Response

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.6

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.58

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.41.0

alumni-caltech-edu.mail.protection.outlook.com

IN A

52.101.8.36
DNS

gzip.org

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN MX

Response

gzip.org

IN MX

�
DNS

gzip.org

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

Remote address:

8.8.8.8:53

Request

gzip.org

IN A

Response

gzip.org

IN A

85.187.148.2

172.16.1.3:1034

services.exe

152 B
3
192.168.56.176:1034

services.exe

152 B
3
10.135.189.123:1034

services.exe

152 B
3
192.168.144.131:1034

services.exe

152 B
3
10.127.0.6:1034

services.exe
10.135.150.237:1034

services.exe

152 B
3
52.101.41.6:25

alumni-caltech-edu.mail.protection.outlook.com

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

52 B
1
85.187.148.2:25

gzip.org

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

52 B
1

8.8.8.8:53

alumni.caltech.edu

dns

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

64 B
126 B
1
1

DNS Request

alumni.caltech.edu
8.8.8.8:53

alumni-caltech-edu.mail.protection.outlook.com

dns

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

92 B
156 B
1
1

DNS Request

alumni-caltech-edu.mail.protection.outlook.com

DNS Response

52.101.41.6

52.101.41.58

52.101.41.0

52.101.8.36
8.8.8.8:53

gzip.org

dns

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

54 B
70 B
1
1

DNS Request

gzip.org
8.8.8.8:53

gzip.org

dns

34aba4e1bad5039e637740dc5a4ec50cb946c111e136646b30a1ea81e694d8abN.exe

54 B
70 B
1
1

DNS Request

gzip.org

DNS Response

85.187.148.2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp89CB.tmp

Filesize
29KB

MD5
6e3d926cc13f5e289860d7ca9be7eb50

SHA1
7e4605f62cd2698740ea276bfddd4166b636283c

SHA256
e6b89cdecdeb98ed52a9a891947131f2380803bce861f9cb4240ce8698fd20c1

SHA512
0850914100b59f803a08f1e90dc747eddb41362670a65bd0ce6086e3ce165d224d0ffbfc16cced3b60103ad6daf8fe0d3033eb1267f8f7b52d55c7f8bd317f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
186e76c21c19973c439b7fd6709b3ced

SHA1
a75b462619f716f35cb8be049e7372715ea79fbb

SHA256
683e94bb51bd337f48a677d176011f5a8f92af737b82c535de5068f7b6ae1ff5

SHA512
372e34fa0c0a7c01f69fe23ecb0d0c09c730f0a54d2a61934b602209da5de3c5bfb8220c2cd7c234be8ce4487ea39dbc510f2089035a5af583999cd37f580683

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2120-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2120-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2120-17-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2120-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2524-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2524-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.