mydoom | 019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1

General

Target

019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
Size

29KB
MD5

260712cb6c4fae7f8ba0b6b44356ddb0
SHA1

d6a1dc411b7e25f9f3895be51b47c90bb1f434fb
SHA256

019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1
SHA512

72d82826df1af55e823a573971a7233f40f0d8da0cdfab034f83bdfde794fbd23587f3d5a2572b730d50cb4b62c0505313c613c04bbac59abd4497f7f6abaf65
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/o:AEwVs+0jNDY1qi/qg

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/2324-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2324-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2324-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2324-141-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2324-145-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/2324-152-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3140	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2324-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023c54-4.dat	upx
behavioral2/memory/3140-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2324-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2324-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2324-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000c0000000006c5-45.dat	upx
behavioral2/memory/2324-141-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-142-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3140-146-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2324-145-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-148-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2324-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3140-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
File opened for modification	C:\Windows\java.exe	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
File created	C:\Windows\java.exe	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3140	2324	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe	82
PID 2324 wrote to memory of 3140	2324	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe	82
PID 2324 wrote to memory of 3140	2324	019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe	82

C:\Users\Admin\AppData\Local\Temp\019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe
"C:\Users\Admin\AppData\Local\Temp\019c12131f205b572e86b5c851f8cb6296c9ed7112a038596d4b39e7f72a0fa1N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\WI3PH2UT.htm

Filesize
153KB

MD5
15750793e1f1bec0b55046b5ce55e888

SHA1
99e2a96746d9feed5de59b435e84575370d1422d

SHA256
caf7ccdb9e4000fd8a0775d3db506b0597572b93d7196b1ccd546660804e49bf

SHA512
17ed197c54dee3814451691acc41106a8013aab178e4614a5b81f6e51869c0cea23fcfda67ec6fb0e6c29154247312fd2dce1be76d98c6ae36fad3153627f2f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB409.tmp

Filesize
29KB

MD5
46a8097a8cbbf5e339d43ae83f765698

SHA1
7a9c5886b76497617869118728a92a7e947042b1

SHA256
60b1a8e52c6898c3d68d3df7a4699cfcee72c54f91391b22b619db80b2bbf881

SHA512
feab964d95b883f2126b4a3efaaf28af7de12beecf34f533707c17bd58ea54819837d23da8ef4f402b60c5c6c39894c20fed88b7e840bea0cfc207c25eeec85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
31fd9154942a810e2b7794dc788b27c7

SHA1
b91659a238c0da2e6844e038387faac339778849

SHA256
7722126b4946e7ba82eac1a85d7f731755d449d7ae46482996a4d787ec859df2

SHA512
02104da216abe17e9899ee861d8a1c2666fe204218d9689f21b486f01cefa01ec110869fea1ce090317693ec92a1598015cc693e80832c4e7495d61a50362ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c3e166aab8426167d65e1a11f35d5464

SHA1
3c96fda61bbbb755e051b9da3f28c5a8d27cbd7d

SHA256
ef9e363efc2afd1fcb52cc48adf3ba331d339551011ae9026ff039ab9906d1b8

SHA512
db3f8700f280ec2bf66727f12737c1006233d0eb17582d100429bcf5619560b26a169084d2372885a6a415759963da569afc36a8bca69a06e0e6ee0d8fcbceef

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
5ebc426adc66dceb9024aa441f2f0162

SHA1
5e0ecd19991da01e2d712d85f3ee0b064fb5c3f5

SHA256
ad2542289b68d864e2d2178cd773b0aa7a2896981c9b4e957526860ea5badb76

SHA512
8fd0a899f7ee5dbd82dc245c444dec82f6992d96da53cc5aef0e9972fa58eecf5d5aa3c2e66167cb14839fe4cc0457da1db5ba4f498e9e23529027eacc2cc588

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2324-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-145-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-141-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2324-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3140-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-142-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-146-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-148-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3140-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads