Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
28/10/2024, 23:59
General
-
Target
33c59886caba391b2968cc57aa62bc3ea7bd63c09d6b94b3967a00aa984a3c26N.exe
-
Size
218KB
-
MD5
eab7cb3751b510a116a299e2f3f06920
-
SHA1
85296c8454a62f28b6b9e203df364b9badd68c66
-
SHA256
33c59886caba391b2968cc57aa62bc3ea7bd63c09d6b94b3967a00aa984a3c26
-
SHA512
18be1441948694f2795c624ac2f0c1e178cbcbabd06d9fdf5595174ad0d8e261d82ecc474cd73a52f692e198a3143f1fe31643ad141a974e1a5baf436229cb86
-
SSDEEP
6144:3EQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:3EGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c59886caba391b2968cc57aa62bc3ea7bd63c09d6b94b3967a00aa984a3c26N.exe"C:\Users\Admin\AppData\Local\Temp\33c59886caba391b2968cc57aa62bc3ea7bd63c09d6b94b3967a00aa984a3c26N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD53915085602510124c3ab0614e6652667
SHA18060ad79c6fd81fdfc8b169cf82f941b0da882ca
SHA256d1e0d0cf293ef03c31a5ef4fd3369671f9be50413d4ee04ba1e6f637987c9d6e
SHA5129a6364c4d5b37122dae8f7838cfa0026383e0b2b9abf65ef5742bc8105697e10f3b1c0867f21706c5d368afa01dd7744b8989d1ff62798552cacebcc01d1538f
-
Filesize
218KB
MD515191a23fda3da9eb676696c9941f5ac
SHA1e398ef4d0f26ca4d2dc384c147189fde462bde48
SHA2563a7160137e6a069d005cc30ddad02ed81fb671feb5b500d1df9dd19f72fbe973
SHA51227d99fcad729844de8bcd1cdd77ff39bfdd7dff3f3b3e012fb6bf239e2878637e252aeb626291be18e65cb355b5ddea43d354e633351e992b31271280ea5604e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB