Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
10/11/2024, 09:59
General
-
Target
1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe
-
Size
204KB
-
MD5
1d6e99b3003b3d3e770b864db99400a0
-
SHA1
f7563dd64e43cdbae2d32c361f31c2d4c5a53a8d
-
SHA256
1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4
-
SHA512
a31d620314a9eef6b37021cf31f5efbaa2c64abd3982dc563b90b6cfa027d75b3fa17910285bc2338fd99c41b00b4715639a54d8ab4c915e990c97227ce34d65
-
SSDEEP
3072:F5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:FLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe"C:\Users\Admin\AppData\Local\Temp\1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b62ed41edbb5eb98bc3fe082c3ae40f1
SHA19ab4bb9c60be4a7408256775e9eb018f70a68c67
SHA2565205d3d48a4264d564bd9a6382fd12c0be6ebd995e7f6ecb9376163c8377a3d2
SHA512b8c988ee8a497b1e6fd2d20ddd9b112a146fc24aa48b5672d29f17b4267b7adcff8aaea77c753c3b9128c48ebcfcc19ca2dd9ff6a9544b7be75fb3b1c3325643
-
Filesize
1KB
MD598452e4d8c892c3e88738092ea92e432
SHA1366ca68d5e1544982aa5dda836bd90dc1b8b5132
SHA25600a667fff6368fe65b7321815e078365a0d01c0b24ab4bab084503a93c3688d3
SHA5121ad6b41fd0827982c9f3ab2ff7244a129197d6ddd546199fbc7fe05ed9af9f7ee5244f870ddddbee28d3c44f35634ba87e27a8bde9e857fe7ecd9753701cd96e
-
Filesize
42KB
MD55a4485756b0b09a143c9e86a8c2076b3
SHA1b6e151e03d49bc4699b21fd32d3c11c6d4bd327a
SHA256430300aaa912a5e004ac0298adc449330463b6e76e35403d3c13c653c7e2b583
SHA5122919f5de9056c862e05076d7cc6903114d6503e30684e7b256ff5fa85595825ff942bf14d4c62a345d69033adeb6fa873f96f7251be25239058e43fa33ab61d6
-
Filesize
204KB
MD58bc58a2f35157d10a43b9a9be78ca50a
SHA153db8d24e0007942b32398f5f7d9867fd296248a
SHA2568702c8e61a71fd608a8f35af13112289b71938e1567c77f6c7912b6cb5b24645
SHA512ae92168ff90088e1f4c955c0a9eb880e7f1e7b6aa11de0bb08c47e57029bb4f508d4205051c4e3f8842ecb5fe19da16d84397dc51350382a03be35b9a8585a92
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.5MB