Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-12-2024 20:01
General
-
Target
5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe
-
Size
218KB
-
MD5
c28621729b845cddf4cbb4027a36fb40
-
SHA1
2ec844fdde08ba6b283825bf50b2cd295c953c48
-
SHA256
5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9
-
SHA512
916e48bfca397e8dc8e46c79818c34903146f1182b472f12d25ffbebf7b19229df718bf9b17a0086cd5f631b807cfad72f5128e9152803b032a710f640361019
-
SSDEEP
3072:Tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:L1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe"C:\Users\Admin\AppData\Local\Temp\5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5d483780fd7a4df82e3c63c55c784578c
SHA1ce7d97a721eee185e118285db69fc8e4496c2da9
SHA25655ef98102de6e1dba85369d1af9a790a309c540610c82dc30a322e86ac318dbe
SHA51286912d25cecd1a4ddab0eec4ec697ebb92ed7f3c106bc81487902d429b422f3188f487165ae03a275a5e381b46da5ab4d5d0f07b6f66d7a337fb669803756fd4
-
Filesize
218KB
MD582c96ef63b2d74cc581dcf299d356157
SHA13f16f0ca59f8136f4457f281cf253dc4416fb98a
SHA2568b975063b995486a3430b78a91494a7a9b4f52d20bb533569e79cf545f553f9f
SHA5128674c993977ae046fcec41bbae3964d8cda53c69d44381fbef4057fb43fdcb02f3daf6b2066e298c3a17918cf3802183e14e892fd2f67422a740562c5b56f0ad
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB