Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/11/2024, 00:27
General
-
Target
385432d1dfc56534afe68c1c388531272ac84485106a68ac09ce65595ce4f2a2N.exe
-
Size
208KB
-
MD5
9ef3058659e38bce3783f2f1e1938950
-
SHA1
be4dded65a144c652b41dbe3b77716258e225b95
-
SHA256
385432d1dfc56534afe68c1c388531272ac84485106a68ac09ce65595ce4f2a2
-
SHA512
3646ce3a61f276c68bc14ff44c4553dee89f28cd395e211f5febd66c96270db3dab852393a1c710571890d3db6b8dcd19ddcc0043fca7b27f577f1b5f138d7b1
-
SSDEEP
6144:6a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:6bapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\385432d1dfc56534afe68c1c388531272ac84485106a68ac09ce65595ce4f2a2N.exe"C:\Users\Admin\AppData\Local\Temp\385432d1dfc56534afe68c1c388531272ac84485106a68ac09ce65595ce4f2a2N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD5bd05e6d8d01f8c2f3fa812d00098a467
SHA17fff6c8b17edde13ccf69dc42fa22b67d463787b
SHA2566ff0c8fc0a5c8548112664eb158fe7d6af47709a90f66785bc886c0b90be9d30
SHA5120b3a863457a19b97e66bb7da779d43d9372f2a154495e05da050b4bb2281581203016b28d625c59ceb2512f350fbd64df1a2b792410ab282628edf84cd9c6774
-
Filesize
42KB
MD5177a9d0ab56a056a0ab25a56b0b748b7
SHA1c426769d0873c33d776641c52b6369a472ac3a13
SHA25651150ef921b945585a3434d4e00554ad1a8e33fc41dd08330cf8ffa1827ab68f
SHA5126052a05050735eb7c0795fb7953e7ca535965d2f6a43d7d64d5ab97fb81eb5ccc76231b189547e38e361636acd0cb7308a55a0438c27d2c6efcb8b3f8da7d1f9
-
Filesize
24KB
MD5664294b45c08f740b7a2857c8f37024f
SHA1ce8c2dadd9c8462e75c0b9071d075953b2607c77
SHA2562949a88581753073a404188007c61eaf80d1e12cc721f555332a764629258a97
SHA512f6824ef38ff4ff8b8c2d47ed0448b2bdc24679996f1e3b4408280704638b3b9abe7d473ecb78444dfaaa61bf10843b38a949225a221b57877aef8c54a6f6a666
-
Filesize
481B
MD55a16e8934aefbb017a16655de38a739f
SHA1df78851d07f028205494bff5a8a96d7eb2d76603
SHA256da9dc5fe1c66402ac8bb2b809405c8b732515764579bbdf9a5397808b128f2ff
SHA512cb86fd9896671bc50beb371521fc393709baa04c8dcde8fe72de76081e67e7778384c49d6fd31be86c5c5e54667a749041de32efbb9776a38a863c9a7ca5c15e
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
481B
MD565c6f15f9ae2c9049fd0bf9a229d324a
SHA126f9bfe8d728ddd3b7ec1faa4897cf407dbc3594
SHA256834f8edfc597d9d19a47c9b29892b8522f1ec8420acc4784f7aabc05e8731db0
SHA5125b9fb5813b61f312f8d26b3a6587e86e1795b8ff7dbfe24bd80fdc3f448d2646ecf24edbdb8cfe99a72389ae5ad089f6e6be2bb67b968aa7a07b6451596dacaf
-
Filesize
208KB
MD5d31fb864939350601bc85992b8bb7e80
SHA1d3fe9007f38e13bb60421f5ae51e4dbbfa77950c
SHA256703ed9c7a24a8dce484f7edb5087a8a472f5a9f6ea54795348801ab5663f821e
SHA512210cb1029f576c799a92eaf62d76a2e177239459f2416032887797b4f1636191b3ede32de94d15e7c6c4ac19959a7fa828cd2c4e2bd04707b24ae804ff2baac4
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB