Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-10-2024 01:31
General
-
Target
68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe
-
Size
230KB
-
MD5
63ae4c2bc1cda3d043d3238877f63c90
-
SHA1
c53ec3b49387e80a035698e394837139e66db68a
-
SHA256
68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938
-
SHA512
0b6f9aea541abae61292dd043c389aae902f6deedcc15a26f79753c6ce6f3580bed2d32c62289d7e880d00ee85cef1de3177c4f7eaa9be8396a4f0d9960a288b
-
SSDEEP
3072:qIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:3DAWw5NV4EBXWAIT/nw08xTm3E
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe"C:\Users\Admin\AppData\Local\Temp\68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5c3a8c05b25c18b8ff12b34409bd31309
SHA1c7b3f0369985ad33c1eafbefad171ca5b6f99676
SHA256e319bd4b104584e33af3a96dd488a4b73546439495f636db53b5351aebaa9a1f
SHA5128e8e7652b1e0fe3fce293af6f6b67466e90beed65e7588c4e1419bfa5c87f09c2cf0494ea42c4b6135a155dcb06ddff4ec782a93037f8792dfe66ae9f159917b
-
Filesize
42KB
MD5e7f4726a5403151641e036f0ac9fff9d
SHA17fcf2698090007598e5760655646f1a548b7853f
SHA256b554be1d501bdfbe9cd31cc82dfd4c7959c028a5f321182c3e74de0c61d0eeb5
SHA512aa4dfef3d71974bd3b4b20a32b8700567dd6f8c19bec8e13169b4bf3d16f46ffec8eda4f28f02ae525ccd8d4cb575e7b145821961d0533ffe3dcbfdf7697ee21
-
Filesize
230KB
MD50a6016c5c92054d65f841a01bab60a6e
SHA1ffb748c92edf7d9aaf2785ac558786f510e91861
SHA256aca8be29743edf69001414fdf10f0b4f8e90531562f727739348e963989c2282
SHA512e54a912f46ceee16c668645c1311a94a80ac9e99ee635de4fd4212c8dcd37808b5e63b1ce093a37de6afe09cd90d90b897e13ed65259f6040c8e874f086b4ad1
-
Filesize
324KB
-
Filesize
1012KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB