mydoom | 9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85

General

Target

9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
Size

29KB
MD5

2dcf88f0a43ac9be5a1b4ded6f96a5bb
SHA1

0692c87660e436af51341f0bb1817f54b86eee14
SHA256

9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85
SHA512

1085be88bd4481248f60f2ed07b826250df9b502fd6550d8a059f10978e157b5cf124a69138b784f82435580c743991cf248d1dd41302dd1ec64991384e2add8
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Hq+:AEwVs+0jNDY1qi/q/H

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/4216-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-44-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-174-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-176-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-186-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-202-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/4216-206-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
5096	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0009000000023cc3-4.dat	upx
behavioral2/memory/5096-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-44-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000021f51-55.dat	upx
behavioral2/memory/5096-175-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-174-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4216-176-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5096-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-186-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-187-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-202-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-203-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4216-206-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5096-207-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
File opened for modification	C:\Windows\java.exe	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
File created	C:\Windows\java.exe	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 5096	4216	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe	82
PID 4216 wrote to memory of 5096	4216	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe	82
PID 4216 wrote to memory of 5096	4216	9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe	82

C:\Users\Admin\AppData\Local\Temp\9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe
"C:\Users\Admin\AppData\Local\Temp\9653d1c9f75ebc0216e73684dca614c9691b7d75b3ea30bd2c3a8a647bbacb85.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\XEQ87LZ0.htm

Filesize
153KB

MD5
2cbd4b130ace45493092d6232eaa1767

SHA1
7e7c7bd978329d5a0c70fe31fc462296bee3c48c

SHA256
9511bc4b1316c09adf1c600bd28d2fbbdd6362bf09638a157eb9529e76e56db1

SHA512
d514fdd49c61465183ae2caf67538e342353221731c00af6f17941b46a1271e888acae795d0d8f9d6a70cacd5bfbecaec48e33a340f78520dc214bb1af4da07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp191E.tmp

Filesize
29KB

MD5
12937bfd2d00d8bd08be5c70fdf90239

SHA1
53b8c624f408d2a1a179da14f4eff90e4cb98292

SHA256
8d589578a05125a1bf4ba344bf1eaa2e16952c902bae10cdaf5bc977f614e4ea

SHA512
3bed11c9b5a4d6df6897590a980bb835880f515f72b8c67a73729ff395175f4b5d377c40a6dd0be316f48a241a3a4cc266cb5b34f33cf62dc9f5248e69104d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
a46ebb746fb6aa0e24570fda23098fe4

SHA1
a849ee859da4b88b6d40664a9283d7c660c6753c

SHA256
db626013c34142aabac4281c06225cdb6470df7516d3361e90fa9ef12a696e56

SHA512
e2db2a7e01c97aab26a141fed6939e4e926a7460bc3d0f4603e2c773fea9fb37aa5024c0bd15683a6b60fb784f3cec33a712e5982f4293b1f00da763274c0e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
c6962a27d3a466737962f1fadbb37227

SHA1
5d2ff105509a3e2e965fd74e3923eca8d5d510a6

SHA256
1e2a778c7a9215c7d2692f5f14aed2afded751149da18a956d5e3b3d0edb2f05

SHA512
d82f7309ae90a2d530155933baaa60bdd57db3e5ec75d94f5388a82943d188458efb8c250e095a8978f6373a6c70fdec86c443888aca2d28d021cedb86217530

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
b278e05596e184f69ee443531f3aeb7a

SHA1
f028f4895532e347a88194650b665111bf7461d8

SHA256
083a14131d853417c514175d0f2e6e74729a15f968579d81c3379709adfed578

SHA512
a0067f8c3e9e2796b27f4a14533ae0a8045d139cac56d6d0fe0d502c3d8a6a0580ad2a150e3fbaa76e7f234578313a0925f79c86625bae919db43886fd75f772

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4216-186-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-174-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-206-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-202-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-44-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4216-176-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5096-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-175-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-187-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-203-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-207-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5096-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads