Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-12-2024 23:42
General
-
Target
ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe
-
Size
204KB
-
MD5
81fec5c76ce8ef51be4f893b16907c80
-
SHA1
792c2b37e7f9fd0902349759b747183a9e0e2ee0
-
SHA256
ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064fe
-
SHA512
aac22ab33c00a2527721009456628edb9f53ef82f98a947710c68429b895ae3812d204fa50c9a99afe297a6519a5bab05914ee12869bca96e7c2cac3b23de655
-
SSDEEP
3072:U5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:ULexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe"C:\Users\Admin\AppData\Local\Temp\ccedcb0874cdfedc68b3f3c828d744c26d23926af45efeef73508b61d79064feN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55512ffa8e7d35e400fd130c2b0f4f3a3
SHA1f6844517fadc6a834620e8972b473fd194f689b7
SHA25695ee6bb463d8539bee00e65cc57acbdd3cee37d83cadd7e2afbd509cb99f675f
SHA51272e7e4159a8c7951d348a84be4adb052fcf556461a39f875793249bcb1d4967b047c01af622be85f477b90bb2245c8343169cdd40f8304ab111b424093437239
-
Filesize
42KB
MD52e5b3c9feadb5a1a32a41a5209caf3de
SHA1ce9719f7006acf0c275c9ca6d2122d82c02f5427
SHA256d4085e9419f17c1d91afc85fa43aa8744c54f0cba3c0699ba67cdbbf22470b01
SHA5128d86f60f622e8b468d85e8c42e28f4e161b4ba18e217e9d6bd53da6ca3fdd6ee199d09c5e092ded39fddf3985ce1b7882541eebff94e29910088b17776e7d2a1
-
Filesize
204KB
MD51f51ff204061cb90d2266ab2b8798254
SHA1368260bfc82189763af6af0ee079caad33fa1d25
SHA2567d3e3536d584b0e2a08d6479cefa5dd707bbe7eb4cd41611afd974ec0bc18536
SHA512ccdf321c109fb352309b311998296dc814112100252ae0f79daa5e377be1b15d453b899774fbd80fd2ceaed3034cbf052a882fde2ed4ef890636861be693e9e2
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB