Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/09/2024, 21:37
General
-
Target
faa745e744e7c5176fe41121d6049c40N.exe
-
Size
203KB
-
MD5
faa745e744e7c5176fe41121d6049c40
-
SHA1
aa60e77f369afc6d31a8251589662ee68aabdd77
-
SHA256
1a81665bc96cd286c5d32b6634bbe4285cea25f3c7577c2897a24be234fed72b
-
SHA512
c0cb058dafe2706ac4c9531740977ea5a5c3f8fab4dc2e4d2501c18384ef3e4dfb48739885d58f80c47ae62351a73a4ff2a7f91cacfe95e577d7c03abd817752
-
SSDEEP
6144:lEL1lvsWYuOiMnGNuuF8XcfI2MPO7qhnhF9mD:cnksHxyXcfIRhFE
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa745e744e7c5176fe41121d6049c40N.exe"C:\Users\Admin\AppData\Local\Temp\faa745e744e7c5176fe41121d6049c40N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5a19719ad34a1e283d840a77d12fa05e4
SHA150e6dd5d4e3f7ff09b65c0cb991818fcf5152954
SHA25690e4218a5a9752fc515673984099d2d6f19bbdd930d1e7a0dc7f2555332d586b
SHA5128cbf43d9b4546b2b1ec60b5533c92ab1d9bfa47e7ba67535a42b81b1d66ee53adfeb6599e1bc188f44687c03e43a8c15a622f32b3a9d6a5ef139d12be43a2296
-
Filesize
2KB
MD5c96d696678f0814cbdf38e3384c77810
SHA16492cddc70e23c190d1c6317f1756a25e5d95ad2
SHA256b99a98b0b85bd1d89a51ac3fd4f6481949c58904b8b9fa2a691c239501b95907
SHA5123b1f7e98c7cf4f79c69863d21095c6ebf2a63cf2e7863d414301487d79dd3ac700e471b5e31242a4c24c8f5307816638d9212abd03b05b878cdd2226b6e89e89
-
Filesize
1KB
MD5fef1bdc8223e2d04354f9e5cc9dfadbd
SHA1fa6523c13d406a7794b54e81c2193365cff23d95
SHA256c62a1fb2d6b9e5ee4b289e820520609472abbfb8c9d3664c6511163b41299b3a
SHA5120d6a0f448d3cf29845db129106eff3f236ac8450791c82149ebbbeb3f28b2c1fb6b0071d4124619b9b95c4a6cdec3130badca7dbd3b01d25b452d5ffdff0b294
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
203KB
MD57d1330888738c085e50f23350e4ddded
SHA123206b8385689e4cb03835defbdd6a713ae6c76e
SHA25626d5fd618a9182ad411b5d87284a13808f772236ae4a32fe0a8967976421c46c
SHA51212d2b7bfef1c6d2d42a17881de2ca787c7c9d1100c959d2a5e6d965b7673c28632c91d78a9ddb169146d74c39cb858c4513da49d976695c1f60103261210d0f7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB