Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/12/2024, 13:53
General
-
Target
d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe
-
Size
208KB
-
MD5
d7c67f08176c8178a88eae31d34783d0
-
SHA1
c44c5ca6b0b2ad507e3cb3b038ed61eb1322c640
-
SHA256
d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2
-
SHA512
67cc24b8ef13ac92152ab9edae066d0f4a221cd9ee6f973011edcd3c254e423f5dff893abccab058de3e5eb6af4799627442f802b6d39d5a02e18ee687d8ecc0
-
SSDEEP
6144:8a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:8bapK0JCmRcU9vVokfr
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe"C:\Users\Admin\AppData\Local\Temp\d6cd3cc7b53ffd5c45a7bb9353dd7e07a063723845b17f5292ed8e8d1f4a93d2N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e826c8588de5b4e41de8502b41205a4e
SHA115cddfff2e111eaa5fb4b394c043dd4dba941792
SHA256f3eb5f7950ea2c200172f1d95c65d5c551d794aa7c759b566c3ca41f28d1252f
SHA51271170bd18036accf208f48bd6fcda7e9831a0f4410215f8a1a03c1463b1e94c94bb507d949eee9f354b95f2417e324a9245712e0426fb3b795bec1cd5823d7ba
-
Filesize
24KB
MD5af8c26cfa438cedf556f8affdd9c063d
SHA1bb8a6c71791a8faa05c7519b3c54d6d1fce928f8
SHA2561715f43ec73287ca3f0d3898dd461f1b461c54a32452e56e9e30a624f8e4247e
SHA5127a29289b12cdff306c6fea2391cf9a9b450bf65a3e60ed98e2e2de133ab2ec3408b802cf442f8c87221821af3363165f52d17ab1705f4bb7171b171156504a96
-
Filesize
208KB
MD5a74e2e8cbe7e8b1560e07efd83b4a0b2
SHA1f2e7a2cc7d094cc6ae23110285af5ce3039dbdf8
SHA25645c710027f2dac40291c283d73baa5c33fdf71e552adb6bf24a9031cb47fa380
SHA512bc6bca4efad19ae3eb72f740cb42b50dd63907e2d9ac75fe16fe6c7517d070c1f5ffa914a0b146ae5fb1179a457765b0c5c233d02f4a2e53fb79442ee73fbf73
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB