Analysis
-
max time kernel
113s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/11/2024, 09:12
General
-
Target
eb661452f08e01c7fffb2cad08926b6cca55be13f092ed4d5a746a88da696e90N.exe
-
Size
380KB
-
MD5
5c0403e60b15eae48d0c21ac5f38aa20
-
SHA1
cb41d710349a4966471a1148ff27500bc80970d8
-
SHA256
eb661452f08e01c7fffb2cad08926b6cca55be13f092ed4d5a746a88da696e90
-
SHA512
8962c105910e7d9f066af0f76f97d56c7462230c7d78e0a197bd96846b56fd513d21b9ce50d36728cac137ee1961c343f8482b7b668ea8d4f8fb142cb85cf0df
-
SSDEEP
6144:haEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:tmWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb661452f08e01c7fffb2cad08926b6cca55be13f092ed4d5a746a88da696e90N.exe"C:\Users\Admin\AppData\Local\Temp\eb661452f08e01c7fffb2cad08926b6cca55be13f092ed4d5a746a88da696e90N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5eb26ca9f168ced0a8347ba312e3a2c7f
SHA199ed56a4dfe1378d3840bbb003a81edc19350acb
SHA2560de8a3d78baa029745b175c839d3dd696936fdf52274873deea276eacc33c471
SHA512d5ae1f26b3858cba36e08c8abf74b156e4f985d0df3d876b98a4e4c0b8e713da4bcb2bc4b07da17933cd2569e9434d6223f764ae092eacec884f3b275b177799
-
Filesize
481B
MD5676131b3928e2f82ccae80af10500ff8
SHA172151453461b1d4a8ce8ac43475bbfea3bb28b99
SHA2562f1b7c79e2a10d2be80b17dcebdc0207662aaf2c1d00a9ac9489c255f315d7be
SHA512d6ecba5e0a2f14a0fb701a75ef37c323bc317fe530f1f6d24ba13b6d32800b5a34156f03a7091526f6098d365206fb8d25b09e01f5636f5dc15ea26515ebea8c
-
Filesize
1KB
MD5aa7b6e6afdd567e60b62f80fcbc44d62
SHA12f18dd5803116a66946883574b0007573e911e54
SHA256daada23b9c6b5bd4a033e767feff7e474e4e3733df3a27fe24ae933678e1de3c
SHA5127090b1c7e5605b1f510a26b19a9939c5d367d082ee81a239d4f2cb4fca340c9c9d389e90acc29e20241d3ee54cf874942a3d13228f9192b8d132432b32af5a31
-
Filesize
380KB
MD5d9c9a67dd297cae9f82cf0357f1d35e2
SHA1fc7f6ee1ea876ef734255df82a1d8b009938a788
SHA2563896f92db63e5c2bd5b8786901e76dc22d6e30b07f83f1f12d64e8265d0a39e8
SHA512206482a77e8989d104a6e9b3fff87ee0cc293dddb867d223c3f03aeca17285b10f74a3f4f38b8d3ab5c647a4e696c675d2dbfd728e55ea782289b7a94a921d83
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
428KB