Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-12-2024 19:53
General
-
Target
4a23b31a02ab7295dc98ded9e2fcab2d6571235e3f79b997fc58417b35ce8c1dN.exe
-
Size
217KB
-
MD5
89add04b21175bbbb636d5ac21ec91c0
-
SHA1
92555de051c253999a2880329d545b59d8c82ca0
-
SHA256
4a23b31a02ab7295dc98ded9e2fcab2d6571235e3f79b997fc58417b35ce8c1d
-
SHA512
bd9cf58ca826b7f9c8668b2f373be0a810a847df1815b2ab42a1fdd11c75f373d7c305f76af52444f560ff12d82282843de87e7d69e58b177645501000dfd172
-
SSDEEP
6144:VrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:FsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a23b31a02ab7295dc98ded9e2fcab2d6571235e3f79b997fc58417b35ce8c1dN.exe"C:\Users\Admin\AppData\Local\Temp\4a23b31a02ab7295dc98ded9e2fcab2d6571235e3f79b997fc58417b35ce8c1dN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50a19ed73952962c5253d7ed450f73746
SHA1a19275011d96d4a720975814f10021cc1c1e0923
SHA256921ec76ec189e8bca44d68fb0aa0e1cb76eeaa0396981d80c6a25f0dbde598f0
SHA51273f624dec978261128c5592c01ab74484d92b4152cf682e0293cac13e3c213acfe51c8c175a2d642fb81f06a352743c6d483740ac48da2f93ec294f367d11e5e
-
Filesize
1KB
MD54c8595725ec59c8749f0a3db86dc2c63
SHA18188970d13484d794cf643a9cfd62476b2d02aad
SHA256b1cdc8d01f33e477f646990e75f06497706ba8342bd5de581476c84811c9fad3
SHA512b7fb2bb47e098a2dfec9c39a55d93264d79911353cee76ad01de700d386d6f48ae6447b72b35a65647f3c869e23620fa75082b7776c9817d63c4dd9a24e54585
-
Filesize
217KB
MD5b870f8008775ec17b2323088d4b0bbcc
SHA1b8d93a1877ce5c6f75dfed8b28951ad6d5e9d514
SHA256c7ca7f5d1dc3511afe7f35c7dc7e171a1a43becf05758e0f47d494dd6657bf52
SHA512e066ca38619e55544a49382bcff697cbc88cfcf203845ac7a89ccf86a7e5681595c14af0adb7bc10a10593d647e8702f8c3d284a8a8aa2758bf72e2a61c208c1
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB