Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/10/2024, 00:38
General
-
Target
f0edecfd0cbd376841a3d0088f628ddf86c1bb08d765a106622ed2dbc4610b66N.exe
-
Size
208KB
-
MD5
1f1ec6f233c4dd5599493ff71dd88e10
-
SHA1
99f06f5db53046f5157c2913e404c1819f4ecf06
-
SHA256
f0edecfd0cbd376841a3d0088f628ddf86c1bb08d765a106622ed2dbc4610b66
-
SHA512
f8bb7312c698116e10e541bdac5a7154ef0dc137ea8b5bc42cf8610d98402f72d7805d4620d64632cf4be861c78cfe8ee37a4b2b0d3842469b389fee19c061b7
-
SSDEEP
6144:aOYX27lPBA3YDMw4lj6idlMlwl7/79C87:awBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0edecfd0cbd376841a3d0088f628ddf86c1bb08d765a106622ed2dbc4610b66N.exe"C:\Users\Admin\AppData\Local\Temp\f0edecfd0cbd376841a3d0088f628ddf86c1bb08d765a106622ed2dbc4610b66N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD57b58e835a0afe1ad10cd330359452fde
SHA176622a7addbb7a6dd6a5e9c73739f6c61a64082f
SHA2565b3417e027fbef8a597f5b62d204ed7283444606341098ae9f0f847a92b06f0e
SHA51210ddcd726a70021536392ef7c610b55185ce7a8e4de751ed014a2ff58513f027fbfd5eaa9fde092dca245290481466a77543f80a901d38d7668e52a7001cfdc4
-
Filesize
2KB
MD5f196bb5fb3e3497d94a60aeaa26d0d2f
SHA1ae43a36d5d9cf11a49d38da285288c168bb83b47
SHA2565d0ac8efebd5dc0b8fc1051826e4043f3a4eb5c059de24fdb3d9e96234ed85f6
SHA512ef5c98da922c583bc3473802044b24eec856e6e340f6b64c4381460d6ae238324b2acc91c26662cbb5ede61873fc9ec2b6b625af390b38fa68acec54848009cb
-
Filesize
481B
MD5a44050bb07649f6b589b0b3c9322c3cd
SHA194104539eeda715d17e82e55682c9c7debbc4aef
SHA256056569e631af22041358d497d2de2d5f453831726e7d62381cd8e3fee9ae8636
SHA5125fbd58c89d3fc0ee7fdc60e0df338a63309c1e04adb0b0c27d38850c0a872ab144956d17e89d39a99eddbd3d9b5c38a84da642ae174da73f07d9c2c68a3a78bd
-
Filesize
208KB
MD54d522037f1752e5ac031f4d5190218f5
SHA1bf27555713ccefb367117b92d3d7507d1a03d486
SHA256151df635fd4595a907bf612ca452253a85e190b5bfe5865d455caf57590431ad
SHA5123621ddf779c70d26efcd8ad85ae4ffeed7b50943c10511d3a52872ab0aa65833e4370e91e884b282063e72db17651601eb4e3439bbc077e0fba3dc97253d7d85
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
796KB