Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26/10/2024, 02:37
General
-
Target
6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe
-
Size
399KB
-
MD5
fb989660e85c97608ea2113cdfb84360
-
SHA1
0c671aeeb4a4bb9e351df35d6c9687d320b76da4
-
SHA256
6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80
-
SHA512
46dfcdfb127f30031151fe8d2710314c618ab9384fa96c525c73519018a3dfa38381f1925c16231c346ae8cb56ba9c013ebabaadf733ff84f03b359b5100b57b
-
SSDEEP
6144:H4EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eir4Xd5Md:dmWhND9yJz+b1FcMLmp2ATTSsdr4NW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe"C:\Users\Admin\AppData\Local\Temp\6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55849be31711604b2f72e520762c59c64
SHA1ac263fbbe9594f393d1679ef564eaedd14209745
SHA256a651a953f4927c04c949203223c86fc41683848510fec59da5815919836a705f
SHA512291e3fe6ec0977eec7437b851346a3dfb826842bf78d9dbbe8bbf835f2ee75aafa3e76929d6e92f927d86cb07f621780b4bfc44c636d01da225a8d097a112f19
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5e6528a787d9b1eb41341f0ab9a133a5e
SHA148230c0d7c0bd243b0742f1b9360b497470a4043
SHA2563e483d6df7ba5987425cc00e5e0525ee40facf7d2096d298c2319181a9728144
SHA51252792768add0294fd677253f6dbbe2f2ea09083e6cfb5df06e8ed0e799669a147d9311b2601515012bc16ebba9ed4d8271b7589990db1eb7f9fdf8b38d515237
-
Filesize
399KB
MD5ce6b5638be103ac5d58a1d70dd925126
SHA18c09e11b494fdcdb70582deb5d8446d9a93749e0
SHA256e35571e93b413496b42472c1462a44276e27850d73f0ddc357495e63664048b2
SHA5121d3387e68b061f5be6778319a48d603877728542e3db2b5e6a104d8ffdd1bff32110cc3cf4ec2c02aa81938a819ec0e97e27f84d9b3b5958d45fb8efbee93e4e
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
424KB