Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
07-09-2024 12:33
General
-
Target
Virus.Hijack.ATA_virussign.com_fcf6de7351633752cf96e861d60b2a8c.exe
-
Size
211KB
-
MD5
fcf6de7351633752cf96e861d60b2a8c
-
SHA1
548662dfac5acd8306b09d0af1385b6615b423da
-
SHA256
def2f0b62f4af989da3cd943e3120ed81c9fb24979925faac774cca11eb2ea54
-
SHA512
0365c358f470843623ab0d425adc53e27027a82e02f800629c54f2913d285f827c85bb35f103743b2a4664cb24fe92f0f1f152bea1eedd341cb9f5c6011325b0
-
SSDEEP
6144:+mKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:w71YpQiU/RcO1VQInVob
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus.Hijack.ATA_virussign.com_fcf6de7351633752cf96e861d60b2a8c.exe"C:\Users\Admin\AppData\Local\Temp\Virus.Hijack.ATA_virussign.com_fcf6de7351633752cf96e861d60b2a8c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD57c589a0591afe74fab1fd55273605b4d
SHA1938bfd7a222e29819bae978225f79267f6977008
SHA256d726245919c4609e7cd5f0383a466d445ed1e75f4625f54a44135aa1f100f2c3
SHA512b96c62838ee8b8d5d98a9658ce2b267f37211521473c2502406abd191c4e2ed95949255d001383cee6dd62738e2dfeb35e16def0e7bf4a6c4a969f9810cb25c9
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
620KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
620KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
620KB
-
Filesize
620KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
620KB
-
Filesize
328KB
-
Filesize
620KB
-
Filesize
328KB