Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/10/2024, 05:13
General
-
Target
80b677b43dbf7a1ea5a65e48f7494eb541f0d8d5c0221b6960288f8a9afc5e1fN.exe
-
Size
218KB
-
MD5
393e29bb0a65e7c4c865e5fe4f172110
-
SHA1
7bdcbbf3e7bb77cb322d03e01c442e344d9b587a
-
SHA256
80b677b43dbf7a1ea5a65e48f7494eb541f0d8d5c0221b6960288f8a9afc5e1f
-
SHA512
e5528f81b34f18ade94a9d7d49108fa0dfa81e7a5649174b93071b014254a5cb2e0d2ff8b0c5d11b4777e690da484514607b10d1c05dc77e6aac5b0832372e7d
-
SSDEEP
3072:evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:g1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b677b43dbf7a1ea5a65e48f7494eb541f0d8d5c0221b6960288f8a9afc5e1fN.exe"C:\Users\Admin\AppData\Local\Temp\80b677b43dbf7a1ea5a65e48f7494eb541f0d8d5c0221b6960288f8a9afc5e1fN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD532f77d6897d59b06cde09ab3de69bd96
SHA1d00d3f0d8e265152ce73c53ddc3f24e0d42b0b52
SHA256ab74f07d5e5c65f1b7334c96eb764dbd0d7192bb42c7db0dfa0c1a16461dbf3d
SHA512fa97f327aa5488b2b2d8ca402e0fe05d22fdc24f986047572fa54f6aa8763915b9de4d0ddb5a59b8b1c4d0ffc3b3cc97162d713b2c70e4534a4d999c45df1db3
-
Filesize
218KB
MD5b9c89b2979ec417210d9c3c8803df0a0
SHA13b269f1dd76a821b523722263d11f6908e533889
SHA25604a9f6c7053597204b351df7011b424e816a4cc15c643864bf2f6bf89de71976
SHA512ff060855ac8830dd68285ca84f4a10888ee309d5cc8724c94d7c072fb492c0a08c874559e1e5a2b52382b54c5c92ec4abb00349bdf942255db41317a95ebd338
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB