Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
09/11/2024, 07:19
General
-
Target
7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe
-
Size
355KB
-
MD5
571e61844fc14ad4b7119b7b8d7f6e40
-
SHA1
5179a197b3c43e263b6fb287fa18899dcb805e7f
-
SHA256
7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7a
-
SHA512
cc3d7287fcc4d9ed87785d6b22e2999c3ba02f28e5abcdb0919ba22f745a8f51a5ed5cd7144d3cad8ca1a180c21c00a7ec9815997fca3dbb648226eba1fc41ce
-
SSDEEP
6144:73EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:YmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe"C:\Users\Admin\AppData\Local\Temp\7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5fa79d2c792b41ba36d0e702832b3dd76
SHA1ebd1870854c72181da363999ee7e781f785bcd5b
SHA256d84544139c2be9b18cb8d079fd657ac64f355c3ed03992fc47bf957f6c03cc01
SHA512e9541af140eabf0f96f58456499bb013044561930e28a3e6bb314e8a3d0f9f267c3b01c78a754ab79a688d98aec5e6e892c0ba307b34f954e396e256c9db4301
-
Filesize
1KB
MD57d63bc8322ddccb1f1191d5515e17271
SHA11725276588bcea5a38fd793aad459a36a67a35b1
SHA256d545e3dd53cc5b4d123d26fcefcb3f88b0c1f53576f35f70f36002643f56db56
SHA512e6c84ce0b9f8be7df153b17f66f920333b686f256130c89860ca52dff14c835aa978da109afe48374a776138a2602549a5e7ac2e96323d0e77ed9ed818263c4a
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
355KB
MD5ff2d0209791ee23dda4266282e4e0284
SHA13993037dc672a54ce62513ca0f1c89c0ac1cda35
SHA2560d2b30ccba04cc6cb8a3da45d2e89492669e6ea4eb4c9a95eb1d3ae5e6012303
SHA51254e3887caceae1ab148070e8d230548a10d3850dbaf9327f1c00610d8002f1755491245372fcd2718ea54ceaa351e48fd4300d844a81778e885b456d0651b078
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB