Analysis
-
max time kernel
112s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 00:31
General
-
Target
d18d87ef3d2819e00db37693a4a37072f293160a22ac2cd80294c50d48ee9e43N.exe
-
Size
218KB
-
MD5
63b466549af48f2feec25cce87679fe0
-
SHA1
7ca6f4fc3ceab1d206f2171c47dfdd5f6cd78bbb
-
SHA256
d18d87ef3d2819e00db37693a4a37072f293160a22ac2cd80294c50d48ee9e43
-
SHA512
2cc98ca454169db22db383fc13ff475885d8ba835a2a86ec19571b6a13f4e8bc37237728cf9c53040825f297c0c8545422b67b410cda3354f66f7d6146a2760c
-
SSDEEP
3072:tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:h1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d18d87ef3d2819e00db37693a4a37072f293160a22ac2cd80294c50d48ee9e43N.exe"C:\Users\Admin\AppData\Local\Temp\d18d87ef3d2819e00db37693a4a37072f293160a22ac2cd80294c50d48ee9e43N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5206f0eef585713d96ba65cdd5035eb02
SHA100f7e9d69d779bc240d785c105c4a15acdc29299
SHA256b611c3416cd5052fd9cb5226cb6803345deccde033232f2da5e3d78852b0d947
SHA512f19fe6cccfe1846663c0e3b784333d42192e1a1b471fdc49bed313848b1b43030fcbd8af684f5a54a88b4aa09af8adbc1de159260e8ac922e175f042a9a80148
-
Filesize
42KB
MD5143d9c89a1cf489b0bfb20a8784281e4
SHA1184a9db4f7c297f9945acc1c22370750e44bac15
SHA256e38515aae4a4d14a78fa00a98a69fb9004ea61c4182f1e6943f226ffd319780b
SHA5120239eea10727529ca8f78ce1b27d6f4410679af460f4e408553053e21c223332c6f7908c7615d9d87adfe5b4f9ccf0a85e5f799b1eb0944582ec6d4be76b55f7
-
Filesize
218KB
MD52b7009e83db691dda8a6902797901fc2
SHA14faa913cc5b93bd2d62c3f2e8e67b48719bf6c54
SHA256cbc7b4232be5085d2ef5a8a15d039715f7e7373c51f20e12c18f8d1d4e4cdb9a
SHA5123b9f215128cdb168447192c09ce0367bceacdf001836cb076ab9e47191a63fc9201c464bfd33d876278dc3f2bb72a94fca1d72e41030ad5d21c501ef75ee329b
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB