Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/11/2024, 23:41
General
-
Target
fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe
-
Size
208KB
-
MD5
182180ece4741cec6bff8ea8c0c69d20
-
SHA1
bb0647c96c9d3042da3fffa6adf247984e4da2d0
-
SHA256
fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29
-
SHA512
663865540321b55e11bd8cc19a419973dca5d134b24a11bd38b7e4420502929c462f61acbeb7b1a010bdc7ffffab0a04c115ad77cea00b7a8009aeda5172832d
-
SSDEEP
6144:4a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:4bapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe"C:\Users\Admin\AppData\Local\Temp\fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58e863937a023f36958a40c6372fa050e
SHA1129ca78e0bd5435285005279e08dede96950e538
SHA256635a8502f4a9209150dc570fa97bf30020e03212910befdf97d2578f1c05e65e
SHA5121787969df5b65f456db9b1661114f40f9de873514b20a59372c5a31d3fc7d3418ca399382c0087a39547a1f06a2a96d2b5b953d5c779653098599e0da491c598
-
Filesize
42KB
MD5ad4827e54897fb3a3234e894ddd4f778
SHA130645401313a6731b513042d6f6c1b15c3d4028b
SHA25635d97648c441bead6fb6a8027b442997006b8be52566e9a2f17af1154eea78e1
SHA5125854990018c549edaf8631109d885ecca63a33b6bc7b25099f9b93c2f79a4788f926297269621c84c273bf96f4b5808b328d5da44dcd7e1e27505690896a29ca
-
Filesize
481B
MD518b6da937416a7b71185740376bc074b
SHA1b6a6c3eb68c0b42c20d2f775aac79ef122ca63c8
SHA256b788071ca2e511a66af0fbec5887a96d662185c0cc52264054a3e0905a866a01
SHA512ad56fc2068fc1ea1643c2b9c3c13b188a3e7dda35cdd52be0a6175a45c2cfcd2c12bbf58e502e0520067be1c5c82c278d5a2cb12f1331a00600eba047b582f77
-
Filesize
208KB
MD5b39c6ee2cf4ef3ee34c507e6e0fbb482
SHA1462443abbc3f1b1311b871a94c86ff8db42188b9
SHA256b689b08320a8047b548eec76d4d834d3303f28029c2e79571ae60de320e1921f
SHA5128ad7f067f4d83cb0b22249a8d46005efe8ffc179a7fb5ec54df11c24615c809964713f0be595b3da21ae378584e90cb1770258b7a2e09cb96d868adc21f5facf
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB