Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/11/2024, 15:59
General
-
Target
4f972bde5014947126779960e57fa00de7dcff185f93c472badbc3524d384187N.exe
-
Size
218KB
-
MD5
5d521db6750551a16c01294a8b0c6e60
-
SHA1
43e21699fb91885aae43f60718a5a44f5cc137c0
-
SHA256
4f972bde5014947126779960e57fa00de7dcff185f93c472badbc3524d384187
-
SHA512
bfc1a89829a30b21fd1a92f64f69ec008dccff654493225a8c88d6561a3aaafcba5dbc9b244d1a00ea4e9c1955d3af6ffe5e23e6f48469a3264cb10ebdc6fdde
-
SSDEEP
6144:AEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:AEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f972bde5014947126779960e57fa00de7dcff185f93c472badbc3524d384187N.exe"C:\Users\Admin\AppData\Local\Temp\4f972bde5014947126779960e57fa00de7dcff185f93c472badbc3524d384187N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5596a2fc8da049c55af9937f0a0387dc2
SHA1db93dd85415f0bbc8b1196f484cd058dd39c16e8
SHA2567b0a46407d17dfd6da4ffc930afd854a5377b427706b99fc5ddccbb5ede9a190
SHA5123bffc48bb99b7161cc1f9ca74064cc39adcad277fce91e191b1219d4970481e8626cbedffdf31a5b178682bb5b44bf400633a25d6bb3d8d6cf924b236d1f2126
-
Filesize
2KB
MD5a5e823d55fcb5bd99ef69dfcc5a51c24
SHA1756538f831572be7ecccbcb7b5ced52b6c1ed4f7
SHA2560b9741ffac244a0b75899b0449768259d0476111af7fefa61af5805567097010
SHA51244e7f1a01b9c8e7004eb58fcf85bbcda33764fd645316a1bd2313b93639fa377fc6ef35faf38765942317ef2188eb4c920e421e2a749cea742663c5b3ee28a99
-
Filesize
218KB
MD50e6b3b76fb87a405fb3a4a74b5730148
SHA1990d482bf19d932ee85b5e465246f2720415b30b
SHA2569e83b9f7e416d82ef76b786724867410f674212d9ca4f5c513d616c41963db8e
SHA512e75990309edfa3b548c790e9c9c5902dcee86da46744058c350fcca292da0818a92e468d20ff5e198e41f7051fc1f64e83a92eae15bf695ce58bc939c2eac532
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB