Analysis
- max time kernel
600s - max time network
600s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 01:19
General
- Target Mydoom/1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
- Size 28KB
- Sample240611-bp1apaycle
- SHA256 1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp2FF3.tmp
zincite.log
zincite.log
zincite.log
services.exe
memory/312-159-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-171-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-166-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-164-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-48-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-123-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-50-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-55-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-154-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-60-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-7-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-152-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-95-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-147-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-99-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-142-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-104-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-140-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-106-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-135-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-111-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-130-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-116-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-128-0x0000000000400000-0x0000000000408000-memory.dmp
memory/312-118-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1972-105-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-122-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-127-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-117-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-129-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-115-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-134-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-110-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-139-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-0-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-141-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-103-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-146-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-98-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-151-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-94-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-153-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-59-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-158-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-49-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-163-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-42-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-165-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-37-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-170-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-35-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-30-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1972-13-0x0000000000500000-0x0000000000510000-memory.dmp