Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:23
Behavioral task
behavioral1
Sample
bugoodomainV1.3.1/BugooDomainCore.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bugoodomainV1.3.1/BugooDomainCore.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bugoodomainV1.3.1/bugoodomain.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
bugoodomainV1.3.1/bugoodomain.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
bugoodomainV1.3.1/bugoodomain.exe
-
Size
589KB
-
MD5
7d09fcd123d106e2c43b94d73daf3013
-
SHA1
8d965454b5d1fa8dea39efe4a3d7ed3712daaac8
-
SHA256
0bbf97aa95997bbaf5feeb97b047e74feec9d2d2337c2a6d935dc7d8c4e23914
-
SHA512
45bc68357c98699f02c04b0d4929310a8b691266a8427bfcd05dd1cf1cbe9bb8d10f3de830c7c31097c0bcb09a23dc8aa2f8e1062b745d0d561bf4febff25369
-
SSDEEP
12288:tUQmnfHvqEK070mrBYa8vlOlV+/C6Ymsc5Rd+qySILx7sm8pIkLSEFek6oS:tyvvqAn11GK+q6tZZySINNwBMk
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/2536-0-0x0000000000400000-0x00000000005C0000-memory.dmp upx behavioral3/memory/2536-1-0x00000000005C0000-0x0000000000A15000-memory.dmp upx behavioral3/memory/2536-5-0x0000000000400000-0x00000000005C0000-memory.dmp upx behavioral3/memory/2536-6-0x00000000005C0000-0x0000000000A15000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main bugoodomain.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2536 bugoodomain.exe 2536 bugoodomain.exe 2536 bugoodomain.exe