Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-11-2024 21:11
General
-
Target
7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe
-
Size
217KB
-
MD5
80360709ae2665f549b671272fbc0360
-
SHA1
e2f7e3d660abea58801c088a3c6b887d21b864e0
-
SHA256
7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7
-
SHA512
993b00a3439714657884fb512ae730960a93ba8e2d9dd37fa5b9736ed5a5c770ea6a29be55d4a3cb27c830270093977818356f5acc1b7cb958d6bdb34bd1d6c4
-
SSDEEP
6144:YrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:qsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe"C:\Users\Admin\AppData\Local\Temp\7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57e65bb7719bbcb57ff9dbb356d43949c
SHA1729d0603dd7b7f3ec231a59273e30665ef518262
SHA256721c9f879fdeacb032a9126bc1fa8c94c8cf22cf8aa665d4b5e2eb8e29e30ae6
SHA512389ddf52726c1ce8b4bd0af269eaf19158261bdbcf1f79c971eb91d98af7b92433c2144cae61b200fe9bcb4cb057f5e76b4cfbdda2afc2341c86f5043901f630
-
Filesize
217KB
MD526968459a8ca8270ec5b378c3d1173db
SHA1283ea6221866dfb9c76e2662c0be64a2514ad4bf
SHA25615cd1d3c4a5e9f4f6375268ed6050ff81e1d13c86b120fcea063cbf1ef5df8eb
SHA51222cce966ff82ae3a1ef5cf4b22b956bab8e946190754b8b95a344f0f677c53d452411ffdc2b009c53fbe5efa919ed1d7b13688d618c768d2d06de327b878dd44
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
324KB