Analysis
- max time kernel
600s - max time network
601s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 01:19
General
- Target Mydoom/b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe
- Size 41KB
- Sample240611-bp1apaycle
- SHA256 b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpCAA6.tmp
zincite.log
zincite.log
zincite.log
zincite.log
services.exe
memory/4340-93-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-0-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-13-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-154-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-149-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-147-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-142-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-49-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-137-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-54-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-135-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-59-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-130-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-61-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-125-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-123-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-71-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-110-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-105-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-78-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-103-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-98-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4340-91-0x0000000000500000-0x0000000000510200-memory.dmp
memory/5024-99-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-60-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-94-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-104-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-79-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-106-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-74-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-72-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-111-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-67-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-124-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-62-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-126-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-92-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-131-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-55-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-136-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-50-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-138-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-48-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-143-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-148-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-150-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-155-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5024-7-0x0000000000400000-0x0000000000408000-memory.dmp