Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07-12-2024 18:28
General
-
Target
71708ac5080cf9eb3934f3be25e775c3ab86ed2662b7e17ccadd30b0c74742fcN.exe
-
Size
202KB
-
MD5
c423e84f8fcb16699d744feae8538230
-
SHA1
f0c4bd5e0bbd5138bfb7da01592e02f0d38bd362
-
SHA256
71708ac5080cf9eb3934f3be25e775c3ab86ed2662b7e17ccadd30b0c74742fc
-
SHA512
f09505e4b7c8e3a1d872ee5a94365bebf193303b01bcf1439e8c5787cc682d6c894bc30fd7d1d58ef5a56da3f7ed98320c6408925708824db5ec0072edf814ce
-
SSDEEP
3072:V8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2PcF:Knw9lEs3hhyaubQTkhbrBVL8gbmT2Pc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71708ac5080cf9eb3934f3be25e775c3ab86ed2662b7e17ccadd30b0c74742fcN.exe"C:\Users\Admin\AppData\Local\Temp\71708ac5080cf9eb3934f3be25e775c3ab86ed2662b7e17ccadd30b0c74742fcN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5de1d51fe03a03e8f22586701f31b4f6e
SHA1b242c630c1af1e8a78c628ad0bd22e865c1d10bf
SHA256baea8c8fc3b0096e8b2dbf26d43e9041c9f346a92b94e085651716e24c903fdd
SHA512ad46e2d7a782aaea5ada4ffc358bf6596b655c1cec04e2063a19b11ecd3e9524b06849b1209d5c0443c83eee6df6d0179db99f51216dee6ce7412d56df6f85f1
-
Filesize
42KB
MD5ae3aeb93839312b87a2ab08247836063
SHA1b04943889ec17e49377ad93c8236c295c2b58257
SHA25640c1869f17f7867c8fe501a7e4c82b3d1d514967a0ab1182c9a58d091a950eeb
SHA5120781e41e16474daac92dc4a637aa3b461b2fd204d58bb3cd8595e5436568544bfeee21ba038f69b39fb83b7eee22ccca82c893d1cf3c302dca79eb68ed43d038
-
Filesize
202KB
MD5d886d2df54672fe11d62ee2085820f4b
SHA1a122a7858834d65e907181bc5815f66549fb2cee
SHA256386485856a7a972a840c361bf2db087e8b578e83455d58cdcf46c705767996b5
SHA51271ddf105c8a6905845b76765e69265db42656360ee54116ea3a2c38bcd7c38268cee6bc169c77f7790ad4b33f63b4d0b42cccf72541b87d7870af3869e780bb9
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB