Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/09/2024, 00:02
General
-
Target
d46342bd59483cd3c4551716c4e4dd90N.exe
-
Size
1.9MB
-
MD5
d46342bd59483cd3c4551716c4e4dd90
-
SHA1
e37935db9c76a5ef8f1df2058e22dfec6c617070
-
SHA256
b5e12b545dcf49dc8aaaa108c370f32d3fe16bde32b278210e354fd61b3a2931
-
SHA512
c93b3e6cfe1cd4b44f4d51766d979d0578b0e350c830fb37b65b649682880d821e009077accb67f86417a4fd8d255d549cdc7680d889dd3e06020907402af409
-
SSDEEP
49152:6/+1R7/+1R7/+1Ra/+1R7/+1R7/+1Ra/+1R7/+1R7/+1RY:6/a/a/X/a/a/X/a/a/1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46342bd59483cd3c4551716c4e4dd90N.exe"C:\Users\Admin\AppData\Local\Temp\d46342bd59483cd3c4551716c4e4dd90N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5014bccf646750605bdd12d0e9a82a3c4
SHA1c88df4c7158042c336bd4007de81f31d1d3b4240
SHA256c73cc9a9d31f7f44c7b706869ad0b44a6f4b0ad756f4f924ea58e73407fbf58e
SHA512c9a76246566763f3282b3b4b42866529e1b78b24c86de6c3bb4aaa24aa3d5fa8c79f21aea2024f6491ca4c981528db4840ef75eef718dd7ccc3023c429e72522
-
Filesize
481B
MD5655f2c0b438bc57b0876255edc482995
SHA1e3126586704e47a9a8293d10147fc7900c83c243
SHA25660fe5a0987d7324abb2898b1ebb5da9ed7d441a3ed8a3515a27f4f8e261d78cc
SHA512d3182d5e4d845b9c026647e60ca080cda69e11a24cd446079f3d76272ce6072499f0e99ef83c2f191774bd69788a28f498f147787eece748a9d2b458e87574f8
-
Filesize
1.9MB
MD5a77b5180aae370842a00a0148736cb7b
SHA138d83a1434ab9ad5a5b644aa14985f37a89f65bd
SHA2567ebe75173f50a785dbf6fb13140e9e05f3ee6d04c2efc4206588876a9f0be300
SHA512a2cae8919eea4d6a7ee1ed389fd1ad1b87077db4fdf17b5905af357782b2675000adfd52ad3418e177af91a196cea2be6c0513508e608bbe083172bf7a9c9caa
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB