mydoom | 109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f

General

Target

109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
Size

29KB
MD5

c16f74b0f0ffac9e87c75d5af002145a
SHA1

3e3fff36b40bd2739367d5a149feb2bd0dcb2997
SHA256

109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f
SHA512

3a439fd07ebc27b1eafc2109273161882fa11d2744765182b8d04955e42f924ea915bcfc808b9f99d1875f5439b4f0047b7be84d2e40bd460e26d13daad33945
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/9hw:AEwVs+0jNDY1qi/qlW

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral2/memory/3644-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3644-49-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3644-99-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3644-144-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2848	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3644-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b84-7.dat	upx
behavioral2/memory/2848-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3644-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2848-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2848-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3644-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2848-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000000707-55.dat	upx
behavioral2/memory/2848-100-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3644-99-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3644-144-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2848-155-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
File opened for modification	C:\Windows\java.exe	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
File created	C:\Windows\java.exe	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 2848	3644	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe	85
PID 3644 wrote to memory of 2848	3644	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe	85
PID 3644 wrote to memory of 2848	3644	109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe	85

C:\Users\Admin\AppData\Local\Temp\109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe
"C:\Users\Admin\AppData\Local\Temp\109044a1212c12dc289636314b66f2d517a617ef9ff7ded6e1b4c49109e2dc1f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2D6F.tmp

Filesize
29KB

MD5
dc703c020641c4493052fb66a2815de3

SHA1
3d705f96c0c39de4f3aa5d933e75f19b3c1a0064

SHA256
d6be165108d276780494088e2dbdd11bbf180d18d3989788406373c91d9db2e4

SHA512
2702176152d46c86160ebc890959a3f819a13fd7b3637e940eab8a684b5426494f09727163323c344a00ea641c6cc8e353bafd6e1e6ded51902ba1d19e47d1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
7d12e118f2bbecd2d57ff3890506f30d

SHA1
60c76188dc6fe0e1e39dd37d895e73aa722c2fc0

SHA256
1f61158e94e1bbf2f148db35ca3a7f9ae3c8a3e385615759d408dbaa64c0032d

SHA512
2276572c9ed7981e92ef7c08fa9ca4a496012121c49e36a32925b3d45c8b644c5f3c88040c30e05d70af84d116f5d8aab5b26657bdeefc0fceb8a36db5583b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
93acf1e1cd9172ae0ce453691d55507c

SHA1
b4ba126e80fb833d34f10900609ec9219a909cc6

SHA256
a2e5e32a4c73743d62bc7000d00e61fe35e95ac984a20f97341226075c473f70

SHA512
aa418b0107bd2f3d2569104d64200cb3f652dd276325f08ab923f4bae2127f0231d4e4b562d7ba22068d591b8206848fbb218a2755d2a0d8ad873866fa232941

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2848-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-155-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2848-100-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3644-99-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3644-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3644-144-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3644-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3644-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads