Analysis
-
max time kernel
107s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 08:23
General
-
Target
0b42f2f04657a5f5106f9e2030c02d3df0557c293cb94f6ccbfc46fb536ed07eN.exe
-
Size
576KB
-
MD5
9ef5e692fe9a479f3f27a05dc71d0b70
-
SHA1
89a761967e1777286f483581fcf571ea4369994b
-
SHA256
0b42f2f04657a5f5106f9e2030c02d3df0557c293cb94f6ccbfc46fb536ed07e
-
SHA512
1ce303662283a3845973276a942ccc91b118c2cfef7e14b28fbc9cd36df8536facfa0241b10eca45a25eb6d12bfc438d75dd546b5dd6b8be82b14f87c7c3ad69
-
SSDEEP
12288:dmWhND9yJz+b1FcMLmp2ATTSsdxmWhND9yJz+b1FcMLmpG:dmUNJyJqb1FcMap2ATT5rmUNJyJqb1Fl
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b42f2f04657a5f5106f9e2030c02d3df0557c293cb94f6ccbfc46fb536ed07eN.exe"C:\Users\Admin\AppData\Local\Temp\0b42f2f04657a5f5106f9e2030c02d3df0557c293cb94f6ccbfc46fb536ed07eN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD53d470e4bc90cd02415b8564880435650
SHA1d403bd07de1ab0d0db8e92c0580ba3d1bb809b6c
SHA25640997b4cfa09ea8db3ce044ea53afd69a94f31bd4335819b25710f03c0a3bc82
SHA5125af04c26392f431ff0bfa0ccc0acfc6c0561a1b39287b3551266feb19631e4105fe06384844c2e8ec25856f0a1985f9d240babcdbfb3c7b513c3c3c2e0e80933
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB