Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-10-2024 08:29
General
-
Target
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe
-
Size
711KB
-
MD5
e90f568a0e48d2f12a39b28bbd0d3ec0
-
SHA1
533b490046adfb0b6df4302e387291b819ba3f81
-
SHA256
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81
-
SHA512
16f5f267abd020e98990956fc33d1a783dd298acb1cbb2d99d1b218dbab879d42b488744c091e3e3bc64a7b6b11551760d18416b78addbb07886fc785960ea93
-
SSDEEP
12288:gmWhND9yJz+b1FcMLmp2ATTSsdNmWhND9yJz+b1FcMLmp2ATTSsdS:gmUNJyJqb1FcMap2ATT5rmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD534849a9af7b34b38adec657692c0c27f
SHA164defabe16055cf2eb82163458b3f63327b06693
SHA256dfc2b92646322bdc9082916342b80b0870575a0261c3e83b0d7466dd2391dc5d
SHA512500f4b7bc75f8a1927e73a2cda56cdbcdab7198d125edcf988f7ce3e4803cdb2cccc5021edff794e60fe90c95fb0b29201504b1f811867eda14de72e80b114c8
-
Filesize
481B
MD5faa865866e2215a190b656ed9488397a
SHA10fc05a0772d707d1ca7181a0d5290c05af52f72c
SHA25630fe21b31ef45309944fd1606530c298799bed143b8a75aaf7183d086038b385
SHA5126baaee5d34a1a7e0c8024d2cc0cc09659f6d00de3760248c6d86e7194d353eac14dabce1103fff358d4b3d7da47a3ca8f79e8a7945a39caa64f4bf59e81a1304
-
Filesize
2KB
MD5a32e620ad9807adafc1cb187669e1d3a
SHA187784c0c700f522430c0330cef2b1c97310322a8
SHA256296e90a4f472a308b73504496cdf9c6d64087d86d110c9054b752e56fd9c1105
SHA51211a2bbc0785570a7aa930ed428ded1bcccd8edee110a5b453a75dd7a1f3dc42957b3d9edaae4333abf88bc6a228fb182108186154b91c90e1d6ce3be40cb22cd
-
Filesize
481B
MD5a08afed644d359cd6f031b643a8bf682
SHA1aa78e03932ad6c2872075fbca215b40845e5d920
SHA256ab06fedc7e13445f8f4f36bbcd49fed31bafd093af7030b43e0aae7c82a55d31
SHA512938bf181fcdd43eb826fe18caa000c61ded42dc5031fa9c5623a4d62f125864648af3ed68bee14bafb3cafdf9592396e2644a0d4d40375061a2ab6ed695c55ec
-
Filesize
24KB
MD51c8d8fc03369d2dbfa7ef6a22a55a34a
SHA16ed2fdaf82a07eea3c449016687b8e066fc1c76b
SHA25602d785a598f39047d44e2ac21d018cc355fa5636075d91c477b214b09f8055c8
SHA512c592c0f3de63b08bec46e1f7db93b4e470aa4f2284fbf4049e09e762bcff9b454daea6cd2cfeb81b1a389e47d0dfb0e927f9912e3641d1d7f7f1d180e7a66070
-
Filesize
711KB
MD5a2a7b8448f5e71d490d7d35de67665cf
SHA131f881ea72896a5d0d4efb4e43b1fdaade9c32ba
SHA256f1792f5b653664ab302797dd7763342e329565641b9f472b5a15a51fc37f2ef6
SHA51208ca4f01bd1cdb2e68050655054a9690c80c4767a452620ba73357cc6346efcae125fcdaf6bf706a35b808f65393c3da056db4a6cedb54885620025f08f0bd5d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
380KB