Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
08-12-2024 03:32
General
-
Target
b802021fc6ccc3a8d2a202f729634f136a48c75f5feabc71957767941e57ecefN.exe
-
Size
218KB
-
MD5
93355c0d600b77c2f5728e4cd168e590
-
SHA1
96369f09cf16b5e6f86b8b66bbad0213ecf9e215
-
SHA256
b802021fc6ccc3a8d2a202f729634f136a48c75f5feabc71957767941e57ecef
-
SHA512
1d115dec462553a6ed058ed7654c32ce6b24eeb669ea40d7637708fb1a366fb5d641f0af3c7b07552d0315dcd20f459d084f4d196bd419c5ad944fccb593bb6c
-
SSDEEP
3072:vvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:H1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b802021fc6ccc3a8d2a202f729634f136a48c75f5feabc71957767941e57ecefN.exe"C:\Users\Admin\AppData\Local\Temp\b802021fc6ccc3a8d2a202f729634f136a48c75f5feabc71957767941e57ecefN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ee5265a41ab100adcf97b95dbe30beb0
SHA1be565f822a1a818b3212165c4c8192ae047f5208
SHA256ef416c3677952a51fa46493574a039c78a899780d6943c64832909151c1fc4c5
SHA512b00bc32541a0918fa527e6a5b7fd00fd9309f08e02bff1ebedcec8af80d9d8f9db2e63113780f6a3d54c7837af469072accd242ff486c68385d5ca1e6dede284
-
Filesize
41KB
MD5cf32787ca8af900fdf92f306cd5e875d
SHA175936ceaa8ffa74860fa37a0bf53d6fbe4efc85a
SHA256328dd260d84d9e1f267e36eb0f5c876c37d8b87f988a3aa10ee3d0c5413c9e0f
SHA512ab085b33a3cd84669ddc050eaa0caa2e64b36443b4be0b9e9b272e73fc45054edd12d6d123257145fd9ac4f66a2084e5e8dca55ef15795873ca3c73aeae988e3
-
Filesize
218KB
MD5577c330a8b1374219f659f3aea2e7915
SHA131ea7ca2d6804ece1a18d46b079f8a81d6e77653
SHA256d9037a808bad7500ef6459ab498f028b4476b88ad279243408ca54a539dccc7f
SHA512fbbc3f97736a2267d94cbda0ec3c362594b8e7c32655167348bebb4b1a3a876524bd40a478c6c02398b0b67c3fae087411e6a9760033de1d83e1e40a1f022d45
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB