Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 18:52
General
-
Target
fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe
-
Size
355KB
-
MD5
f7ec9514f3a6ca39dace0b2a1ea5a090
-
SHA1
c5bf4573a491c40b3e64d3bb2967aca450f12085
-
SHA256
fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6
-
SHA512
89c3d5f71faf86cdcf45c5d5c20bd2a227121a79da8a29e86492d1bb7bb23c3ce3f1c4abe9f71467dcede8c182608519b7ba9f3bd0d2fb6988dac81974f52959
-
SSDEEP
6144:1gEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:zmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe"C:\Users\Admin\AppData\Local\Temp\fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD552e8837474ac886f02fb170cf7eb6fbd
SHA104d6dc7b9a43df6491a2b07b7d280b2967ebc826
SHA256653f36398f5f3ca73bc4fa5f33531cec2eb8acbbe373bdb1d9a9d7032cc76940
SHA5123883dff0870533083dd29cdedc524b9b23372618be38d4d071d1abd7efeae966bcf22e765808bd1a3e33845e80691b821f469d004f14b0e7366ccc8a247475c0
-
Filesize
42KB
MD500035910432dac3073d9f20e0f5d1887
SHA1074020583703826818107c0fb13788e696116b2f
SHA256e2a15f7be0f7d9ab34a960f2d82d447851361b08e8fcfbf2f71e96885ab0bca2
SHA512488b7bbbec030f0aa18a09b367ca7df1f6ff2991c995d16ba76b31bdcad0d823cddc90559441edbe9caf00bcd942602e20522b3d617bc2ee6eadf6f686bfc8e4
-
Filesize
355KB
MD5dc699edf56c5ec28d224d5fdecbf8fd8
SHA17e70f0fdf7aedbdaf487e47e67f7468182252e8f
SHA256ab1d630ae77485c1b30d4522a02cc4559d42ab188ea8bcfb8288709cd1e63cf8
SHA512acda89a2b2841fcd6b3b01f9fc8a0c8d54841d5c83576b64e316e21a6edddf27f21f4b77c4618412c4e53a30631a3ee324bed42ba1d0ebb1deabf2673faa2cdc
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB