Analysis
-
max time kernel
112s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
01/11/2024, 09:39
General
-
Target
3561ab51469b0498f919686a1ed3ce1e0f139b8165d18f6a72193d6d1c098079N.exe
-
Size
218KB
-
MD5
97568432f9247f1be2f016027e876180
-
SHA1
d211f5f5e4d8fb5f8db68bef2729248ebf03c876
-
SHA256
3561ab51469b0498f919686a1ed3ce1e0f139b8165d18f6a72193d6d1c098079
-
SHA512
1dbe6c0d9fd5ebd91e5b3946b578e252a233befac65dbdfe1b46ebcd851de39ace7ed3c033b8559c4e30dc0c23b367ad976de89a9e7bb7723e6e58bc933912f3
-
SSDEEP
6144:lEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:lEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3561ab51469b0498f919686a1ed3ce1e0f139b8165d18f6a72193d6d1c098079N.exe"C:\Users\Admin\AppData\Local\Temp\3561ab51469b0498f919686a1ed3ce1e0f139b8165d18f6a72193d6d1c098079N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5fab092917525e43d8f67df4dcb85f041
SHA1a9a460471981d63ffca57cff780ddfbd58eea94c
SHA256b947bb37887dc89e7eaa62ec7ed208f7fc378c1bcc674423c16f222ab1eafe9f
SHA512c9232452f93ec47487f69cbdc20c2344e9ca223500a42f00089e65553299ff5a4c15ec4fdc99ec3605d96d2ce24a8f11d881932ec41cf1f1cc5534e5624b9e90
-
Filesize
481B
MD5b6b829166e114b6022fa820f590fae92
SHA15596d8928764206914079da76c6cafc16fb3ff5e
SHA2565e9bd989e6e10939654acb8b23d6088eadbe70b0910b655f8205cf0fd9a314d7
SHA512bee444ae9466c2e1425cff4f8b0e0f9716f2efd0921efcb18d5a8cabf3824fe3d3464431e24b889d4e5fde9c155caebe7dbe283655c94c74b2c1f0058f3b3400
-
Filesize
218KB
MD536646ce23c5bd894e8b32470badde0e4
SHA14222cec3f679c3084184f6708f61dc74d7228cb7
SHA256b517d2fe146fb85bca24dee21c8db49696e94eeead78a275dfd74fb481163cee
SHA51268759aab272e24792fba495c6bb57a525bf9ed68e2a7c3c43b4933f0d2b5a99d6eea47e9298ad614474ef7a3b52e378b749a18430856dc820e7a79a8598560c5
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB