Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 02:56
General
-
Target
55fa3934bd16b917d39775132ab44adfa89dd5aebc56a2c8f77862ca276582f2N.exe
-
Size
212KB
-
MD5
0b4f50b6070844521ff455d8d2427a40
-
SHA1
4213c6b56cf62a5d27e5d49877d86df9908a487d
-
SHA256
55fa3934bd16b917d39775132ab44adfa89dd5aebc56a2c8f77862ca276582f2
-
SHA512
3c5a426891dcde4592097abc8da413c9001667145fdb49bd1c43fd75aebf4e4b1ad056ed001a6d01ab04865b180a4e128f67e957ed418169becc262a4ad34f36
-
SSDEEP
3072:aGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:aG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55fa3934bd16b917d39775132ab44adfa89dd5aebc56a2c8f77862ca276582f2N.exe"C:\Users\Admin\AppData\Local\Temp\55fa3934bd16b917d39775132ab44adfa89dd5aebc56a2c8f77862ca276582f2N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD58655d2f40e5220dd16276027bfd64b47
SHA1bc3a9a613e6b900e02cf0924bf64c36c02cdef60
SHA256103cb7f897bb1230445b0a0e27bb349ed09e74eafb2750e1182f01d05c3d9f07
SHA5125a7e4ddd99b20000159139005d7ce3b49a229876f8b68c54155a944f0f26157c6a48700aa14a835265bee5bbf64ab5d868ee0564ccf856a7316bed39cab870f0
-
Filesize
1KB
MD563ecf8e4e984466a1a22a6acc2bc08ea
SHA18568c0965da9c1a5320c141a4007e7bb6fa62fb9
SHA25646ab84deaf94e523931b76fd11ba0f78b7a65aca5bc2012383bfc2b6065ac998
SHA512546e9b997111fd927df82a184922822e8d1364c69edd46eb9eac935b1215dd03de14b90fdf5edb3dc82a598db4d16d02813322b7f199ad50b5ce6ac5b2e02eb9
-
Filesize
1KB
MD5faa64b679337442560948f9df4f9bec3
SHA1f2fbe7fa14cb1f511fe11cbc5f9402072bda4bfc
SHA256ea3fb191c42aaea6269229a7dc7cc810bea996783135b9fb5704838fdb2c478e
SHA5129b4c851c0a33a0f0846ebe30d2988fca2ba24077c2925d0495bdae917fd27f37a78daf9968fa42c7565beb29b7b976b9a1fe7061783d1399f2ce0113c1931cfc
-
Filesize
481B
MD5e60c0db832be9b29cb9475ddf37489c4
SHA192e476cf81dcf2645528037e7859e6f35c776af8
SHA256722cbe7b100e3e68587c43788207555ea4564eea8e03d4b57dfafd4992058303
SHA5124b3fa7fab26512c363a86c48d856f7498ce72f29dad81c62443939a8446262e16d88fd20ad9d7ae7daa765f8693b8cf7bce0d6076a1bfd1d65b7abd130f9072b
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
212KB
MD59ba4e772d62d9839540438f82ae8bb5d
SHA1109764f84a00ed022c8f9b44bba45294d72bc3ba
SHA256ef6eb841abf51193b76ffcb7b340873e77453fef4c7b2763b59f3a9396cc256c
SHA5121c0dbba8d3306a86be7de65b08c824461f235b715b24d649ab30b209308c6a7cec49838f9a458e6d7d93cb6591ae91bcc28ada4efba95193a651859c4f66e388
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB