Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 02:42
Behavioral task
behavioral1
Sample
dwmmoowmbkz.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
dwmmoowmbkz.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
dwmmoowmbkz.exe
-
Size
51KB
-
MD5
f217b9268597022851016736519f50c6
-
SHA1
ea10562fbb5232d6a39a1c7c021f3820281f606b
-
SHA256
f92908b7940b96d47a62a404a08828aae33a44674ed98124db287d18da54dff4
-
SHA512
06b2b2dd58ad8a4bdd14655fdb6c3a05ca5fa25543bd455d3122398f9eccf4c8580b23f934d19378fbc82a86bf4886577f3144ce498888dd416a096ae16a6f8b
-
SSDEEP
1536:ae8SMuDd+fK3F6Xs6XdodKA7Dk/Ht0fantpj7B:aeRrAVAPkisHN
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 15 IoCs
resource yara_rule behavioral1/memory/1820-16-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-17-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-27-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-36-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-44-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-58-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-65-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-76-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-84-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-183-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-272-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-277-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-286-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-297-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/1820-305-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000120fb-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1820 dwmmoowmbkz.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uswnci = "C:\\Windows\\system32\\ltwawybsigd.exe" dwmmoowmbkz.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\wfkxnam.dll dwmmoowmbkz.exe File opened for modification C:\Windows\SysWOW64\ltwawybsigd.exe dwmmoowmbkz.exe File created C:\Windows\SysWOW64\ltwawybsigd.exe dwmmoowmbkz.exe -
resource yara_rule behavioral1/memory/1820-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x00090000000120fb-2.dat upx behavioral1/memory/1820-4-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/files/0x00050000000195c2-14.dat upx behavioral1/memory/1820-16-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-17-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-18-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/memory/1820-27-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-36-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-44-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-58-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-65-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-76-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-84-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-183-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-272-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-277-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-286-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-297-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/1820-305-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\gtkciwnsvy.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\hwfna.zip dwmmoowmbkz.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\ybojl.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\aigtyuwfkltj.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\ierpofcrps.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENFR\wizikwldabs.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\gcrknp.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Windows Portable Devices\rqityyldntd.zip dwmmoowmbkz.exe File created C:\Program Files\ebiulo.zip dwmmoowmbkz.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\xdokzmxkmg.exe dwmmoowmbkz.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\dhfykeg.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\chiofdhhztau.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\uazoa.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\savjlorzix.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\rzklihyzjpw.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\pbgy.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\ynyvwfyjbzidy.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\sehsxatdct.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\lmqujifemf.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\vojli.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\paymaex.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\pzitswjfw.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\ywzytjplpg.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\kulzagsh.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\ktugpcs.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\dpon.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Microsoft Office\Templates\laqeyamorrnew.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\ewmeiiafgf.zip dwmmoowmbkz.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tvlvwkwdc.zip dwmmoowmbkz.exe File created C:\Program Files\Reference Assemblies\aaikubwxk.zip dwmmoowmbkz.exe File created C:\Program Files\Windows NT\TableTextService\vnkeizccwc.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\psrwdron.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\agxgobwno.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\feacqxyigz.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\gtjljmvrzowdw.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\keexfawsv.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\iltt.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\nmcnh.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\ggfriqqt.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\nsscer.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\rnnidae.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\mjgkpehndievy.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\vytwlhyi.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\qiheef.exe dwmmoowmbkz.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\xolkqiaacw.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\siuyxhkzkts.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\vtbwmn.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\uhokf.zip dwmmoowmbkz.exe File created C:\Program Files\Windows NT\TableTextService\es-ES\wadzshpcjujxj.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\vgrpspualil.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\wouwxfso.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\rkuobzyw.zip dwmmoowmbkz.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\emydgzyshizhi.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\amfnzbcdfaek.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\iwjq.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\gtlqgedze.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\tmruybhwrbh.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\koxyb.zip dwmmoowmbkz.exe File created C:\Program Files\Windows Photo Viewer\it-IT\gwnbx.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\auryidrloq.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\mrlo.exe dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pturmvdjpyjv.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\qvdmsuaxjp.zip dwmmoowmbkz.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\zvdiwuscbuea.exe dwmmoowmbkz.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwmmoowmbkz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe 1820 dwmmoowmbkz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dwmmoowmbkz.exe"C:\Users\Admin\AppData\Local\Temp\dwmmoowmbkz.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5f217b9268597022851016736519f50c6
SHA1ea10562fbb5232d6a39a1c7c021f3820281f606b
SHA256f92908b7940b96d47a62a404a08828aae33a44674ed98124db287d18da54dff4
SHA51206b2b2dd58ad8a4bdd14655fdb6c3a05ca5fa25543bd455d3122398f9eccf4c8580b23f934d19378fbc82a86bf4886577f3144ce498888dd416a096ae16a6f8b
-
Filesize
9KB
MD5211e1a5e6c5e838a1cdbc9f4336b1d7c
SHA14432c0f0977c107ac6a0878fe94e441d4ca1924e
SHA256cdc1b5512eb2cb5b46080cdb5581260bb8de1006a5091d8fed9bca0dc11b7990
SHA512c35175030654e346dbaf34f9a806f4cc1728859b5f6b188f3d115c5a2c0d5ba7cae5ab1d2712c652d0b7091184df3755fc8da9b2aa47bd22388a8a9ee5e0f28c