Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-10-2024 08:21
General
-
Target
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe
-
Size
711KB
-
MD5
e90f568a0e48d2f12a39b28bbd0d3ec0
-
SHA1
533b490046adfb0b6df4302e387291b819ba3f81
-
SHA256
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81
-
SHA512
16f5f267abd020e98990956fc33d1a783dd298acb1cbb2d99d1b218dbab879d42b488744c091e3e3bc64a7b6b11551760d18416b78addbb07886fc785960ea93
-
SSDEEP
12288:gmWhND9yJz+b1FcMLmp2ATTSsdNmWhND9yJz+b1FcMLmp2ATTSsdS:gmUNJyJqb1FcMap2ATT5rmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
481B
MD55d6ebafd575765425907b582f7ab1fa7
SHA19027130fdffb0e157477e2693967dfbe1279e118
SHA2560e0569ddd8cdabcf85c5fc9e9ab4577266a173e3930453546ef57155b5cef04a
SHA512ec95c26d509377970744edea987d13f1cd9dfbc0202ce83b7e1658dd7ef442535b4ee12d51745ecbf4c56e9d6755b2425b7b44c4311dc6894a6dc0b88e93decf
-
Filesize
42KB
MD5257f07d21042a8d20d8b92a1833622ef
SHA1968a8b813ea62b86007fd02465e46c70526748f1
SHA256a91fa9e14c6b8591989f3eb2f6bea7f6a13962d3bc26825f5db48ad1e46a7179
SHA5129e15b59e35097f12433e2c5f465f8b32a958476965b871e0fe460a0718f092992c5f86b27f5199c8f9cd8d99dfaf6d8f7334267b2ee41361b9710c6631dda671
-
Filesize
711KB
MD54a617c91daaf886cb344ae71ccb6005a
SHA1d627f49f85feb281e9756ffa0edce7dda517194a
SHA2566e47a7b706d1778a5ec273b8d310409327224d49a3a23e6e07c1fef4f4645340
SHA512e579b23ba4795f236113266c3aa80f5a9f1ef1bd71db2f19bfea4eb4124ea04a4b17c8d50e83bff01062e005331b6592ffdc3fa1421ac80a727f2978baf8d616
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB