Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-11-2024 17:22
General
-
Target
2769f48ecb9d81e0da73f92101fb972d22ee8dfdd27c3858f02363c2f15e02a3N.exe
-
Size
204KB
-
MD5
585b496f8fc7088a9141feda554da0f0
-
SHA1
832647722e395b74c0cfa187222d7c1a2eee67fa
-
SHA256
2769f48ecb9d81e0da73f92101fb972d22ee8dfdd27c3858f02363c2f15e02a3
-
SHA512
65fb92d041e7e550790244a9aeb41926716a3d8f6550c373ffd9e5f9df7166dccee2ac82e7309d018f6506317e28bd0ab28e810e0dd3062c9c339f73b5aed506
-
SSDEEP
3072:a5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:aLexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2769f48ecb9d81e0da73f92101fb972d22ee8dfdd27c3858f02363c2f15e02a3N.exe"C:\Users\Admin\AppData\Local\Temp\2769f48ecb9d81e0da73f92101fb972d22ee8dfdd27c3858f02363c2f15e02a3N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59e997ff2bc681153989ce18d46aaad07
SHA143144f3de56713e7c4d872982854912c0680e1e3
SHA256a1cb122104cb864dc3b81e70ad40f60b4c82d83cd5f7387da940cfbddc2f895c
SHA512cf6c47da1e3374b076b18b78ec49dbc36176ede1909bf43c16512026aab250e426827dab993721aad20b76b648870db0e0fa0caa69a213941d9161bde7e96ca0
-
Filesize
42KB
MD5b9729eb0ac5a1c117c424c0f71560d69
SHA19cbd8e202a0e2b52e0572b037f4c11fb5dd2eb42
SHA256d391cf637a565dbc59a6e381afdd45dea9479050cfd8e5335a8fe016fb4e7757
SHA51234a31c871d528e19d0febd43ac516fbcf58c8848427b6eb53a299ca68ec926b683f6c40950b502265bf263961c0e313ac757df3f9bcdbb71cf07c8cd0ae28131
-
Filesize
204KB
MD5522ef66ad25267d9cd4735b55fcf3fd0
SHA1194fe1cd54c16d1f9d1418453b3c61e01fccae05
SHA256512ed0e9e0e19b61232f111275ffc18e56916e7bfd5df086e64581015964c8b2
SHA512cdd984895c620ffe8be16dfa53d3a01f458679e8ebbac6d82dd4e16cbb44fb53f535c32144a642954d7fb278c94ff5d35440cacb8a0402a8062ab7311450d5c2
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB