Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
28/10/2024, 22:28
General
-
Target
e5529a670efcff709bb5fd239a194c5dd853bb9242c1f9fa39b06edcee2f1549N.exe
-
Size
380KB
-
MD5
b51098e2fbfefa832e03a1b1b716e4c0
-
SHA1
97d45b2300c504d2666e11b77e61e0883810758b
-
SHA256
e5529a670efcff709bb5fd239a194c5dd853bb9242c1f9fa39b06edcee2f1549
-
SHA512
926d6b612f7ba3160ce1835d3b703f90c0427846c370661b53086771a4898b8de76c0ea355048337e521f4064fd6fde78ab2acec0fa38ff06f9ec7c7b9a80d99
-
SSDEEP
6144:maEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:amWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5529a670efcff709bb5fd239a194c5dd853bb9242c1f9fa39b06edcee2f1549N.exe"C:\Users\Admin\AppData\Local\Temp\e5529a670efcff709bb5fd239a194c5dd853bb9242c1f9fa39b06edcee2f1549N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD57052c030337db6947e9371a081df1998
SHA1863e2fea98e27e5b64e4d10d7554504f06c83421
SHA25606403802256433b8bba7eae932f5efd18491af019b2d6a48bb7d0df5c58e6c31
SHA512802c7577f60b4804f92223947ecc7d2adbf6d268d5b3a9773c0f780109a60c1ce2796e4d68e5bdce0611a7f68ba284cbcfe73e872af56f65dfc3a2cba550a0d4
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD52c0980917ad5898138e5c1eb0b30d972
SHA11ed6e95bb63520d6ff5dd1b92ae312f1311edcdf
SHA25638cf21a9ec0828c80074d09e4f36f6fd39e7afa4a9bc2020bd2ae36d19795d06
SHA512ca6eaf43d4801e3de3846de99a3b43550ae3c55f7e04e43024cc6a6781efdf34c28d32ae2dd186c826c2e708fb63569ced8638150983cf24f93f361e60ffc2f3
-
Filesize
380KB
MD580cb824e3d9e2474d8b27349ea145ba5
SHA1477841f85363c12d15faaa4c9945fe6f5e052d6a
SHA2563866d79446e63525167d48e794ecb49e488a5bc7f5d3acf90cf5ef8f8222e52f
SHA51226742ffcf213745beb0c7ef0c2f6a3cb5d3a1d9edf84a60030014952216302cf9b6e4f9462682177aced2df150e846575f0dadad9ce5f060fdfe9004efca4b4d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
428KB