Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/11/2024, 03:20
General
-
Target
25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe
-
Size
205KB
-
MD5
fc88b5f30c713cde267c4c8bcc7b6a20
-
SHA1
6bb1abcaa31be22450e525f7d9191380b5010f0d
-
SHA256
25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984c
-
SHA512
18760580d3dd70b83bd77525b324806b2fa41bb6dccf1ad3552369e1e2f3282b4fa7996012ec48476396e3ad0a351346e5f10b4fe120bb04592284d48457e4f9
-
SSDEEP
3072:R7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:zzHnMLm5GNGxHUhtnkdpHqTKzhh8i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 32 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe"C:\Users\Admin\AppData\Local\Temp\25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD506151449944c2ae4a0a6726203e7e161
SHA19b6e574b566dc4c5f8872a8055644954eeb7600e
SHA2562968b8d8f59bb237b3c924154b3df28ea26d15975b126c3c7798126ab640ca68
SHA512b2c809aa4335757dc3343dcdc038095b91d27a4a6f79b8d527ffbd491ef968ee645e41b186711223a5800a9ecd3dccc7bb45b79e7a5809822f25741f420282c8
-
Filesize
481B
MD51033777f3fd754110e6acee2d1d2b474
SHA1177fa668a0d96f99f82c30b142cc41d33c95074d
SHA256e2848ae5d586f7ef58eb71fbf4a0f1fb6fdef681201251ff1f8959e3587f1ac9
SHA512f6b70dbaddefbd5dc71183854a448aa8a64ccbd2fbf3d3d32ab2a5f8404cfea213fe846fd66d7a59951a4c76291c1fd5696a37124c968a8e5b98b06b56624d5e
-
Filesize
114B
MD5bfde1e9e9c32c1681a16139450c6909d
SHA17e669b927e6a75a10a0ca29e38e58ddcb49b725e
SHA256e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a
SHA512781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396
-
Filesize
205KB
MD5b3e6206b2d0feb03002e9da2cb9e6a0a
SHA14a5d59761a1475972e2402733d216f85d1b2668b
SHA256b1780528fbbda88216058a41c15e4c86870d97c1195fe6368c45cab47e9d4ae4
SHA51223339d04c8e3fb54b328176e07aaf5186b25d7de88bd5f559c6fedbe4c1291dc505f52081fdb507ae7893eeeb6f4782a0d0c473a9c1f64e603bb15bde2ad5a56
-
Filesize
552KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
712KB