Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
04-01-2025 11:50
Behavioral task
behavioral1
Sample
jdsohjaixv.exe
Resource
win7-20241023-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
jdsohjaixv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
jdsohjaixv.exe
-
Size
34KB
-
MD5
abf2dfd7d6c4779df1672f93ff84392f
-
SHA1
75b7b6535875312d97e0479f3abd937dec5163d1
-
SHA256
eabe397ebdacb6323ebabdc5be57204cb74761a05bd78f10135758e8f1f55e3b
-
SHA512
7707e7efceb26a9f2203204d1657a9591d16df1cd09ecaa9c1370d04c49cb2cfc34c7c9605ea3d937a7766232d09c4dd9d62772a6661eb8f756cb0651d9568d8
-
SSDEEP
768:I+Qe+mvs0FmSMuD/dvWJrn3DK3NhdsrXs69ynkP6m:ae8SMuDd+fK3F6Xs6kkym
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 15 IoCs
resource yara_rule behavioral1/memory/2064-11-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-12-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-22-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-30-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-41-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-47-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-58-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-67-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-77-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-165-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-254-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-267-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-276-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-286-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral1/memory/2064-296-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c000000012280-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2064 jdsohjaixv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\glbxvhh = "C:\\Windows\\system32\\wzoubobloogk.exe" jdsohjaixv.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\skxyaku.dll jdsohjaixv.exe File opened for modification C:\Windows\SysWOW64\wzoubobloogk.exe jdsohjaixv.exe File created C:\Windows\SysWOW64\wzoubobloogk.exe jdsohjaixv.exe -
resource yara_rule behavioral1/memory/2064-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-4-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/files/0x000c000000012280-2.dat upx behavioral1/memory/2064-11-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-12-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-14-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral1/files/0x000600000001749c-17.dat upx behavioral1/memory/2064-22-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-30-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-41-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-47-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-58-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-67-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-77-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-165-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-254-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-267-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-276-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-286-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2064-296-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Indian\qzpxdwztwzwk.exe jdsohjaixv.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\llhjhndfloaq.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\awqxobf.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\cmas.zip jdsohjaixv.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\cojbmfgt.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\pygzhrhsolyww.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\lhtrojtloy.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\imrlqinaz.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\tjfacubvq.zip jdsohjaixv.exe File created C:\Program Files (x86)\Windows Defender\it-IT\nxap.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\System\msadc\fr-FR\jofxbuprkmgc.zip jdsohjaixv.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\lokpmfcwcpkkf.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\yiqojzdw.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\wpms.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\tfgunlyq.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\avvtjurrfncs.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\ljfdqak.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\vgpq.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\jigbta.exe jdsohjaixv.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\smvssoyquym.zip jdsohjaixv.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\vlawmf.exe jdsohjaixv.exe File created C:\Program Files\Windows NT\TableTextService\it-IT\awcieqhy.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\iwdqisfrch.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\sxqjhfkjagidy.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\ifvcybsbtjle.zip jdsohjaixv.exe File created C:\Program Files\Uninstall Information\palwz.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\xmgetb.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\ntlrmnhdk.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\xgmj.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\fwrihpej.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\blavluq.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ja-JP\mbxomnu.zip jdsohjaixv.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\cpazzsp.zip jdsohjaixv.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\ufirtzzzxovwl.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\wkxa.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\ehkhhld.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\rfhgfjo.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\ppjieckppo.zip jdsohjaixv.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\noznwevgm.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\uaexgix.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\bcncoddf.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\rsicopuj.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\ftlvz.zip jdsohjaixv.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\fpdzucht.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\fzfzc.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\jiwsiyj.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\vwxwfbdz.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\ewnerddmkb.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\akxent.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\kompyqzmbqp.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\jgnwearf.zip jdsohjaixv.exe File created C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\elxplpzvyaej.zip jdsohjaixv.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\csur.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\csmiil.zip jdsohjaixv.exe File created C:\Program Files\DVD Maker\de-DE\xgrdanygliu.exe jdsohjaixv.exe File created C:\Program Files\Internet Explorer\en-US\hllgdbx.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\irxpqrmc.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\nrwoiauteka.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\kurrvrk.exe jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\wjcemrnc.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\orsyug.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\cwbkvlkkvgoau.zip jdsohjaixv.exe File created C:\Program Files (x86)\Common Files\System\ado\sstgfa.exe jdsohjaixv.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\ueocspll.exe jdsohjaixv.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdsohjaixv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe 2064 jdsohjaixv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jdsohjaixv.exe"C:\Users\Admin\AppData\Local\Temp\jdsohjaixv.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5abf2dfd7d6c4779df1672f93ff84392f
SHA175b7b6535875312d97e0479f3abd937dec5163d1
SHA256eabe397ebdacb6323ebabdc5be57204cb74761a05bd78f10135758e8f1f55e3b
SHA5127707e7efceb26a9f2203204d1657a9591d16df1cd09ecaa9c1370d04c49cb2cfc34c7c9605ea3d937a7766232d09c4dd9d62772a6661eb8f756cb0651d9568d8
-
Filesize
7KB
MD5eedc6d019e0abda501f682666b5a572b
SHA16eb53aaf6ce8f075cbe5c92e17a40d887e29751c
SHA2562daa11d92daa573de895e9bda88eeb35b5dc1feb5075083858446be4d05922d5
SHA5121e383a117830c85e14a75e4ae758de2bc36d9ac69142988571de040aefccc056a111dc75619f102384256065876db46c08afc7c09ebdb5ef81e46c7571a0b865