Analysis
-
max time kernel
108s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07-12-2024 20:30
General
-
Target
315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe
-
Size
1.7MB
-
MD5
adf59c70765a4bf0d1d9c0e5bf5e1d10
-
SHA1
d0defb6a3f4badd8080ac997f25b9d06633a9b0d
-
SHA256
315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7e
-
SHA512
e472ca43b2b9488dddd69e0c5a7b4caed41ade2e2eefe004022c42c6eca20c31f77c8118ea752bc5507843f458271f3256b22f9b76377e9d1e433b2a751b9914
-
SSDEEP
24576:TmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:TmV2AprmV6mV2AprmV6mV2AprmVG
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe"C:\Users\Admin\AppData\Local\Temp\315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52c3bfa8361bb12a4f05f36d7f8a691f9
SHA15cdc7d664afdf18fb961dcea6a6c4e9ac036a7fc
SHA25620b64aa6ce6780de7d1ec94c6a561f8d0a16eaef13718d18221f6a9311e3ba3c
SHA512b1e0c4194f9a9758f5ccbbf67b1a616099b86ffc8318bef364818f2e3f3d8da793a164b103151dbc4ed5e9e19fc83bdc2da1c0a9ef98dc09277f1a084f398a90
-
Filesize
1KB
MD5bfb9fe277834c1e7bc3c677780147470
SHA1a2bf9087d34f4d426fe835aeb39ed51fe9fd33bc
SHA256e241a6af8a6d26b09a11f7ad5541aaf87b8b5b0ad779f69f15c8e4ef82613cc6
SHA51287f552dcb93fd05a1eb6323abc9b2424f3faca6611d808116037af13f18e51ba52fbe7545d277fb746d264bc51aa2638dc9728d7066c31cb1e16438ef5edede7
-
Filesize
1.7MB
MD546ae5004fa6a7fc8b64369f998a25c4e
SHA14e620121c467b5eb80e3780103bd8f1562e6fcb6
SHA256024de9997fb8365e2ac37e269ec108a923257f90f75b983b64fd9ef0be1ad39f
SHA512be0461985a8c369ee29ed19b4e854b7a534266da8f3857c18c133ce63e2944e7a19fc5720bb822215354cb52ef9f9ee50a6ef9bf18fd182d777dd247c8b9c097
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB