Analysis
- max time kernel
600s - max time network
600s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 01:19
General
- Target Mydoom/c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe
- Size 29KB
- Sample240611-bp1apaycle
- SHA256 c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpAA6C.tmp
zincite.log
zincite.log
zuwcskicbl.log
services.exe
memory/2240-83-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-0-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-13-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-138-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-133-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-131-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-126-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-42-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-121-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-47-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-119-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-49-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-114-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-54-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-109-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-59-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-85-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-61-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-102-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-66-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-97-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-71-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-95-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-73-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-90-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-78-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2240-107-0x0000000000500000-0x0000000000510200-memory.dmp
memory/4120-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-115-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-79-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-74-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-91-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-72-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-96-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-67-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-98-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-62-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-103-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-60-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-108-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-55-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-110-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-50-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-84-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-48-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-120-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-122-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-127-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-132-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-86-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-134-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-139-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4120-6-0x0000000000400000-0x0000000000408000-memory.dmp