Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26/10/2024, 21:55
General
-
Target
35d7aa1f1aa31ab5d12ede828a949a3bb5054662bce28e14a4d30cd5312c5bc8N.exe
-
Size
218KB
-
MD5
59399d9865f04a86067eeef32b281e10
-
SHA1
ba9461106ab8c42c0e878363df3b7a2db1ba85fb
-
SHA256
35d7aa1f1aa31ab5d12ede828a949a3bb5054662bce28e14a4d30cd5312c5bc8
-
SHA512
7fb5a369761a686e11498a1a86f944743dffc8ed9f3aa469cfc8d0353d1bea89eeb4dcf309041bd1a2cd65932a3c26260125538d13a8373d71b7edcbff24fbe2
-
SSDEEP
3072:fvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:31SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35d7aa1f1aa31ab5d12ede828a949a3bb5054662bce28e14a4d30cd5312c5bc8N.exe"C:\Users\Admin\AppData\Local\Temp\35d7aa1f1aa31ab5d12ede828a949a3bb5054662bce28e14a4d30cd5312c5bc8N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5c0a521c555694a177db975091f92e648
SHA12087b88fa663926086832df35aaef4fd9c92d25d
SHA256b4f1ef6f440179a6fdb9822763817aa979e3c8c76f644b32f1875ec9446ca508
SHA51295835621a9736d82e44cca82750d47c0c07709ca0bf5ce156c341bd9614943845382c243dc3178bffff14d3e616aca27bbc13790cfb07bbd36b108d9c0398877
-
Filesize
42KB
MD58835407f5ea0b7aee736af36dd85e4bb
SHA1a4ea264ea81db9ed0dbb0838fb039499ef0a671d
SHA25616a515fd73c25d0a8efdc4cc76f8c68a1ab1ad3b3d7fef896b681ae0e44469d8
SHA512f057628b1357e087e18d664a60d8407d08864b7af376245f83933b1422e1d391dc9c468f7db8fbcb48a46fa58684c62279244659812de4c087f5fa239227eeac
-
Filesize
481B
MD503fd51fd40e3349d5f9f34e7c4da719a
SHA14b852a00d900cc340ab0c43cd77613d26b668806
SHA256d2a9d16d2b8919c84d9eb507f2ba35ed9c232de75fbbd5904dee28470eae51c2
SHA5124ea00d6d8eded854aaf95e9b5eb335a2dfaf72d4a50bddf6b4f4558ee7bd7a5e74be5f6b8ee1861d9e57b022371d8621027ace31ca33603d9cb9dc1afba4280c
-
Filesize
218KB
MD5bc961c974216af6975a5ba4ac6aaf59a
SHA135d2ee5147cabd0de9e7ed57db84ecb5b0125cc7
SHA256381ecad3a4b26c702b1459a32d2f245e836614da9382eee35bdbf91746bc3423
SHA51295d3d23893ab2ef3f1517f4f794d4ab165d7fb6f0da40556000f90a0028455cc346b9ee4d44185e582356b8ff0f218ae60a7f9830c8bb63d1021ce3f4330681d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB