Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/10/2024, 11:05
General
-
Target
392d339ae5e2b0a19eb498cd0388f01c7b58f22ecf18d02029fcc75bbabf0e22N.exe
-
Size
218KB
-
MD5
6e8e6ae3a1c7e5b5a9f761af33525560
-
SHA1
8c20618e205e8141fa4116590d2561bf1d78a193
-
SHA256
392d339ae5e2b0a19eb498cd0388f01c7b58f22ecf18d02029fcc75bbabf0e22
-
SHA512
b7daf8ed676bc5765cdea69fbfa3cdf5e228596830ed613cf4e915a73fa4f2ddc5a4d16da168becb0a7c867e8d919202053b4c69ce148e981b3d316fa222cd4d
-
SSDEEP
3072:zvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:r1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\392d339ae5e2b0a19eb498cd0388f01c7b58f22ecf18d02029fcc75bbabf0e22N.exe"C:\Users\Admin\AppData\Local\Temp\392d339ae5e2b0a19eb498cd0388f01c7b58f22ecf18d02029fcc75bbabf0e22N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5a8fdaeb96f537dbec9628f694495b48f
SHA121303fb84944f2f5e879e45acf9f963621f278c8
SHA2561ce2a210ca7027edc388cab03a76ace291525edc4d7c9d8401154085805b3b3a
SHA51257cdf37e3dfafd9d63eeecfa410ac07830da16143999a45601715a8a8132bc2e7e6fc202a15ab0359b82ebca6125f130a65af979e2799418fc91b4adb1717347
-
Filesize
218KB
MD5caf629ca845123f9bc15d8a5a569991b
SHA1f8d6a7385ea8ff7d4b44544e330dbc51ba133276
SHA2565a6a169425f892d6d9032dc84b35723511bbb4daa9063f32c2cd7dc7e9cbb9c6
SHA5122084c807722643e6e3036b818d38943bca869c2677ec0a33fc7ae8173948c91e5469c2d78956b4b6ebc132a166002f0c3fbf1ed4f6fcdab70922686305f2f26e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB