Analysis
-
max time kernel
99s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/11/2024, 20:45
General
-
Target
47bb73994475ea5f8222b3703b24bb9de3f5a5895f1f123008cf04a091c6d38bN.exe
-
Size
355KB
-
MD5
c3ce5f86e9183f40be2bfa1002afed10
-
SHA1
1d071ab852adfbfc909c029a8bc60b5a1d726d04
-
SHA256
47bb73994475ea5f8222b3703b24bb9de3f5a5895f1f123008cf04a091c6d38b
-
SHA512
9370bbb12d76bfd78908f4bcd4c453164f16144856012ddf8903352fd5a08dbbe53ebb7ee7a04e225c0cd1f7c3f61dcadd0648802e3a19196b437e727544f079
-
SSDEEP
6144:b3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:4mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47bb73994475ea5f8222b3703b24bb9de3f5a5895f1f123008cf04a091c6d38bN.exe"C:\Users\Admin\AppData\Local\Temp\47bb73994475ea5f8222b3703b24bb9de3f5a5895f1f123008cf04a091c6d38bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5bd86b52c7f8b2912eefac320d4116560
SHA1ec83e63195406de5e7ba0f82ad3fded89586030e
SHA256c1275759455d62647500bfa792d593fb05fd0fbac11c4897aea80f25df7088ea
SHA512e2d9a59cab651b3ebe7eb5e9488b41049da0bf7bef50779b452989fc5b3015337d2bce94a2831587bbf57d1cc832fc31f65f5b2eaeec2629d0b0c5019aeb5778
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5de98ca8ba5f1ec750461d016a562c4c8
SHA1a95a686d604daadd7d11311e0ebcd6448ffa0e0a
SHA25607a37fbddd0d0539039b4385137356f6f88fa0c2d61599e8842592ae86b51745
SHA512e474a32d3aed4db087e676e2ba1381d51c375a696945e30fee37d676cbfdcc8e70e6134f60795ec7106ed4cb349a019022802d0bf8a9c0f31526eaccd805680c
-
Filesize
355KB
MD593f4ac4313f6f13956d6484bd43304ea
SHA149d9b84c865153e4d22defa763e501fc69905280
SHA2561c3553374fa7a3a97bc17e272404dc5188a15d89bafc6ad09feea4db40efa06b
SHA512f146fb29964e7acb8c923276051545b83e6793b38cacd3d55603eeabdf30bebdb6b8fbe657a117c82a6fcb5dff69b649c276e950e2e7bb17c02694d7dcf6a4ae
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB