Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/10/2024, 16:02
General
-
Target
c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe
-
Size
208KB
-
MD5
85a275b7969afee998593f452493cbc0
-
SHA1
2a69b28ef5e41cf580406c877044e4780887bf2f
-
SHA256
c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310
-
SHA512
9e1f4c05501f6579a646b346bdfa18a2ed49fb8929630dd0b59fe1d15bcee0163c5e659b3ee377493fa8a0be8d72d4ebedc8b8c284a2fd7004ef7154c4a64769
-
SSDEEP
6144:qOYX27lPBA3YDMw4lj6idlMlwl7/79C87:qwBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe"C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD531283e14d611124b3153ef8975a35e0a
SHA16db4534492ab89f9c130832724c0545bc5847d34
SHA256d4d50541156d84e00e058ffdffdc2c63f863aaa0e397b0432f1dd9cd1b77d205
SHA512588aaef3c10f00b75deca26989d5edeac13b58dcc9472d91382e598ca39bca86ddb9e5300ca123367ec8cfa03f5624d054bc061fd2bd7d8192b16167acb5e87b
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD53181470222624160c2558962db2d5bbf
SHA1aa32a49a3b7e60a16efc0ecf36bb848e7314854a
SHA256200d8d35c1693ef2507e4793a904d20f4d90e8c8a69369503ef17b58b0d5660e
SHA512216b7b16c5557b70073c0ea995a9db698fe38992c6fa935c135789a041ca426e54d6e1ac8e67a75583e82cce74cd47738abcc96e77d9e33ba8fb47e258a17a4a
-
Filesize
208KB
MD54f2f1276036934a8030b8a2a94a9c87b
SHA18f82ae7b0ed0caed98e87e8913307eec3bedfa87
SHA2565c5eb2587b665a172e5552ef471ca50f772c8f6013497721075348445d1f743b
SHA5127a8fb31ff930e116da7bc320afab3876ed6877477c1ea4438be11856ea8d04e51f89234e058854b9b7a194a810404bf01afc4dcf1515ea33bea68ef415c42860
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
796KB