Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/11/2024, 05:40
General
-
Target
c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe
-
Size
1.9MB
-
MD5
1065668ef722c801ac71dd3bba7f5c43
-
SHA1
3fa25ff25e02ffb21d5ab90e8d1e85cd265930fc
-
SHA256
90aa3af284e6eee41fe7129fc288550ec8354eadb9dbbcb040e90484abc293cd
-
SHA512
b511a017ac8a3ab7ab9c0ef2d8838dd99f7da694855fe4deeb0dd465c2ee1185fdd6743665415edeae753cbc1c882389c5dc989cc69486bc4ed51ad633172d2a
-
SSDEEP
49152:5/+1R7/+1R7/+1Ra/+1R7/+1R7/+1Ra/+1R7/+1R7/+1RG:5/a/a/X/a/a/X/a/a/D
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555ea1c46c595346de52cbe41a13f197e
SHA10cd8ccac9de23adedf126de755985c7f150f476c
SHA25689cd53f9b7d226be7f50cfe89daf3bc9eb2f66e132108d771ddfba8c8504fa22
SHA5125a361629bf364914894e2ef0bb0084d9ade889976d99c63e6c8a1f67ebaa33cbebcae210bf63710dda95eb43d3709cd95186e9d45c1d12de663284a69f251258
-
Filesize
1.9MB
MD54cdbaf0573c21ea14d07318dd4696fd4
SHA1b9819ea15678ed9f874a4275746244b84038263f
SHA256424acf18e627c791e7a0476797c63e94e4015ac0eafcd647638d2442632f747d
SHA51299c01d4875a7fdab7a5ecf1895f6bbad6835424122aeea60b79797c21441d93e605fbb937f27e64f0ea997bd065b540158d6881c614a075e35bb653a8d4d2c67
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB