mydoom | a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56b

General

Target

a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
Size

29KB
MD5

f25d43b178ecffd38158c0d3ee6362e0
SHA1

fbd6af56369ba7ee336b2452a1a6e9299b327826
SHA256

a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56b
SHA512

c47966340b918008bacfb7c8f399839b147312f13ab15de278d51023306be1ae5b1d91c2f3bd404e1c977ecf0425a345fcec74d2643d656f81b4ccc08b68c9ef
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/2hp:AEwVs+0jNDY1qi/qOT

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/4816-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-27-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-132-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-154-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-163-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-196-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4816-228-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3388	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4816-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000b000000023b57-4.dat	upx
behavioral2/memory/4816-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3388-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3388-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3388-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-27-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c000000023b76-43.dat	upx
behavioral2/memory/4816-132-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-133-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-154-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-155-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3388-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-163-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-196-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3388-197-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3388-229-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4816-228-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
File opened for modification	C:\Windows\java.exe	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
File created	C:\Windows\java.exe	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3388	4816	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe	82
PID 4816 wrote to memory of 3388	4816	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe	82
PID 4816 wrote to memory of 3388	4816	a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe	82

C:\Users\Admin\AppData\Local\Temp\a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe
"C:\Users\Admin\AppData\Local\Temp\a72f529b97742a14464081c1990d3f7ab2079163241f491d33e89a99ecfef56bN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\default[3].htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[1].htm

Filesize
102KB

MD5
b671e4fb092275fe05576a1c6037e4cc

SHA1
15447a8eb56e182c4c18e5b45b304d2dc25481f5

SHA256
77e18efa7b826768908ac9477c0bf917d0f5a0092cea3627a2d86d1dd37549b0

SHA512
a83b6b3350bfaca60c24cb2841ba5c7611fc295ebaf83d706df355994bc936b145fa64a82ee1e6ecbce398826e04d2951135d04a2c6444f0038e3085a4d087b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4CB6.tmp

Filesize
29KB

MD5
58c82a3b06efaebed0d3b84c73c5bf07

SHA1
a37a1fa77b3d2fa111e3b52bcc29c6d852b8890a

SHA256
4429660d0eb3f5ea5d617d97c3fa5ee3f3e26d05afed68355e2d765535947396

SHA512
f83206c939de37807e1500484196feb1ee373ce08208b566dc79d12ad287d907746ef2623c918685a448b4285ea3cb1d15d8b07af95b226b789d429bcce71654

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
eb2a4f5066305b11515acee1c2ac9267

SHA1
b406be2cef865c085a4c0bff7ff725b26f5647c4

SHA256
37bf37c3b4a103ee9b0458a51e5903e95399f07e9f80ed5407e066fa48f1cbd4

SHA512
489e896055bf8595fc7ad825027d583b4708f661cbe1e0760ce2144007acc725a07bc207a2ea91b7c4a93bbd63eac37cef6ad9593e0f6d157eaafa0de47da082

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
71566dde5e20072cbd20aec51d4fd0e8

SHA1
d1b71b13604ebb6dba13575ec0081fe8eff40cf0

SHA256
c6889df4115f7039cb0e5c6cedcd7ac515ea2867396a8ca5b765d79af7faff37

SHA512
33f7574f984c2b7bfc39d9d9602f86dd2fafa4bfc6c17b3cfde8f5ade941e5a2f91ef790216ecd95c4eabd8b233bb7b0d7c35160e9b91d768b3183594a4f7473

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
8903a7719b677bcf8a26747621c5489c

SHA1
82dc69fe4ab35c516ddfea9c9a4ce5a1049e67f5

SHA256
c70822b3e41efb24fa1da52a4d778bee702b3d62a89d7cb94f08fdcbf0d96779

SHA512
dbf8c2c4dbd57aa4ca2ff89d0888203f2210da713699af458ef4b93c100fa3dbea109192bd4647a45af61bb9c03c7cd2c58e032dcc60668253ba23b85d1825b4

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3388-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-159-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-229-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-197-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-164-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3388-155-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4816-154-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-163-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-132-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-196-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-27-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4816-228-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads