Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
02-12-2024 04:51
General
-
Target
3940a6929774c206a56323dc23ba18ada7884bcd8c0710d935f75f834a06b95aN.exe
-
Size
218KB
-
MD5
d4c6144786066d5ac4d7408aaf755b80
-
SHA1
fb63e38cb942ab5a459d4da0540ca937898d7506
-
SHA256
3940a6929774c206a56323dc23ba18ada7884bcd8c0710d935f75f834a06b95a
-
SHA512
2e0f3eb3ac1296405d27b5a1d6341a8e022d311c6e5375faec715a922c5d07971ec5f071a7ff9b3aa166d1f75a00857692e5b62e5cbd0bd492c8a4c7e32429a0
-
SSDEEP
3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3940a6929774c206a56323dc23ba18ada7884bcd8c0710d935f75f834a06b95aN.exe"C:\Users\Admin\AppData\Local\Temp\3940a6929774c206a56323dc23ba18ada7884bcd8c0710d935f75f834a06b95aN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5d21046b80fd4f5ba40e9796a04d62128
SHA1a7bc843112e4910fcaf18fddae29ab75fff1d874
SHA256c01823fb39a5be2de2e191d1309cf3cc2a1c4584d9cd794c70877e094c190199
SHA512e89a20210e2a35a8f6eb90ba573b69c7ab9be88d7c2b53a3112970e5cc409ed21c4deefe151223c3006e266debbc9fd95659eb26fca2c27895daeb8be2d277df
-
Filesize
24KB
MD598588cebd7bb420ee10ed92be9ca2816
SHA189ff5f8e4f0fa95d714228d7e97a3bba6eda59c0
SHA2562fc02de2c51eeb0f04d94deeb8e32d6adad1a313d56266488c449a5144959735
SHA5128c87620b70d18db1926762db03be1972c45a724af99f844beee2b3576a5fbe66bba1d3912690b455d30164bbe6d5a46b35a81369774f01bdd27ed6fb4ac31821
-
Filesize
1KB
MD5733b54245e7a1d46caa64792e4ef6c15
SHA19b539f6d041033235b236bdf39eb28ef520fa53c
SHA256b8e4402880b3d11725fdbd127cdc53d6850d98fd6d8f54d30bc10c09833769d0
SHA512ad75e581faeff7107009f96cd7db4bbb1d8fd9036b7e2d00367b5e42e21e1760011d1069bcd19ae0cc9e3fd3995eecd325d9e2ab47d6958e0a9a3823e0a16c6d
-
Filesize
218KB
MD5591459b545e07dae015ecbd5fe6bcf98
SHA1566256bff72b54bd585a01ba5798cebb112eab28
SHA256d145ea0c87ea28bc84ada079b13ccdffbf9bb189d17200ad7247f504f05ae8eb
SHA512b7d491850db58a784e603b0a771c81f9ed0dd1d6e44f8dbe8c42b627a9b4d76759b6e259bc40585f396ab718061a9d37ccf61cc9ae0449927490d0c297f5624d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB