Analysis
-
max time kernel
109s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 06:21
General
-
Target
745b60c7876d4391540f17a8e02be6cb777639d8506bc8149b03e6fae778ff5bN.exe
-
Size
375KB
-
MD5
afe1175d9c7c911e8c5d963bea352ae0
-
SHA1
dea60f4b85ee751d9b2911357681cb1f0c5a5ac7
-
SHA256
745b60c7876d4391540f17a8e02be6cb777639d8506bc8149b03e6fae778ff5b
-
SHA512
e5d93ebd033ca08a394e550363dd39786b3ac6c8adee521f8b67ec87ca06fff966977c70bed714373cdb3f5ec892b18cff458dad0eae1f05a5480454452159b2
-
SSDEEP
6144:63EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:FmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\745b60c7876d4391540f17a8e02be6cb777639d8506bc8149b03e6fae778ff5bN.exe"C:\Users\Admin\AppData\Local\Temp\745b60c7876d4391540f17a8e02be6cb777639d8506bc8149b03e6fae778ff5bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53758f800405dd07ace21fa1730180696
SHA1f69f52a8d9c6bf2480a6feacceb65024a4301159
SHA256ce16db6b640ac59fb2dfe68d225f9843acbaab6656c31b420b132d6344cbe90b
SHA512815917865b712aaaa7db4a1859fa030498fbe27ff10d88e70ffbf3d9ea06ed8434cbe6d6cdca226a2a94caa6e12378e79f693f3650d288320ac7e5da2de8bdea
-
Filesize
375KB
MD521b636f6f254b079e7e1a77d74a134ca
SHA180cf95fc016ebd88370937e42f6d07a8927044c8
SHA256254f8d8eb9315a5aa3b24f7ca455d631b95db0a375f144af826c6b0ec0b7d4a1
SHA512ff45339eb85601f65a992c1921500768bba17f66bdd2f8f90e1ddea236c156e2083324d17edbdccebca577bd6cf61f61a228aab13843d4ed2a2e2e9ef844ad96
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB