Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 09:13
General
-
Target
d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe
-
Size
208KB
-
MD5
a1691c7ffc2cb981a70bd59ce5624130
-
SHA1
bf8d2c042963d4356feb2274056b22f5d17316f5
-
SHA256
d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4
-
SHA512
2fb12b2f805f2f0ed23795543f3d0eb6603627b8829167d581035448c9de679b94c52fcf7c1fa85c1c77534dc1cfc1207bdc2e071e7d0e72c14fbe1177961931
-
SSDEEP
6144:ca1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:cbapK0JCmRcU9vVokf7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe"C:\Users\Admin\AppData\Local\Temp\d21339abab997bd39fdde7fa0540d06ee8ff0871aacc9acd8f00611fed4015b4N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD56666833cbec3d9565129b4b8ac036d43
SHA16ed2ab2f628edadde743f7068f485335f3c6011d
SHA2562955aca8a85c62b4e6992523dd7a3b9785171b29a68a51e18fdeaa0cf62ceb19
SHA51282ad83601cb901f59e4a12e89efac92ef15df657a061d52de97d151cdc6bed423bfa9e412f3eed8214f04d3d98a65bc7c023d6e84deb8277cd0dc5ab09e3f752
-
Filesize
1KB
MD50077cfeb04d99b5d26b6725dc368148b
SHA15fef2d342ccbbd21a726b9a5282d52109b7fc086
SHA256e47bd5ac850c493e14eb6b94b29aefc357d4a0ff3a35f94cfa2dede5635f6941
SHA5128df4a8b1e61e7520171805e6bdcbca55fb9d488bf4afa0def0b8cbfc5a7acf528838a05a30605ff4124f86a6aabc1caa76c6c964bbcc9e73926c393d7f8a891a
-
Filesize
42KB
MD5aed37ecff1d3b3ff56d75a18c8f273cf
SHA1bdfa826a8bde4838e3ef3dd2362c4c728a87c99a
SHA256046d273f8df60cd95a3dc12a65f134ea0e00aabdd0bb76f944c1c9b93b57c472
SHA5128564d2b7ff5ae22446be1914f6b85b383905fe57f186cddd3d2d67c702f644022984794ff903bad4d298d821799bcc9fe2ab6add28366918df1f6731dbdfd958
-
Filesize
208KB
MD52f5b075545723d1f4b04b8fae753bb6a
SHA1e6800a029d037b4d4dff97907ad3821c1c53dad3
SHA256a84ac0ad48c925903181b51d54ae8b99de5106002ea064cd4f1d1b5bbe2d117b
SHA5127440af7a6cc9094d04bc3a76675e4a4829dacce1e01c7fbb86a9682c81d0be6066ec0b2b73e65e101bd6c618a196b41b6ac53b47b648e2f7f5177cc87efd6c10
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB