Analysis
-
max time kernel
110s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17-12-2024 22:07
General
-
Target
f089f6673dcfb4a792dbd3561f9d5cf47a40af2762bb5a9d62d7c8b271e9652bN.exe
-
Size
212KB
-
MD5
a504348b36c866802aff97cf3092b2f0
-
SHA1
f9d85d564036b123e4aa8066133cd50791ac8882
-
SHA256
f089f6673dcfb4a792dbd3561f9d5cf47a40af2762bb5a9d62d7c8b271e9652b
-
SHA512
639f1a956c62105016f1415d5f53243eac9d6578f1dc38e4713360d652a64533947d9084f705962d27dfce6db1a537f3ffff79f09c30c0751518d901234bb4bd
-
SSDEEP
6144:Cob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4G:VboEj/8ASWM4Ki96/zqIKG
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f089f6673dcfb4a792dbd3561f9d5cf47a40af2762bb5a9d62d7c8b271e9652bN.exe"C:\Users\Admin\AppData\Local\Temp\f089f6673dcfb4a792dbd3561f9d5cf47a40af2762bb5a9d62d7c8b271e9652bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5003e650787246dc13442eab2c51fb322
SHA1df42471e36481db2c6f1da5511157e64f68d6a06
SHA256b68801a8ec13db1e9da82e96e75ea597c363cdb3b6b24dd27f2493923b67b074
SHA512610ddf52dc6d2dade53e149f9f4b753bcb18a104bfef451be606b3e32af13d8e0502637d031f136c744e4131f66da58ea73d857edfb9ad0e7a7a702cfeb25909
-
Filesize
212KB
MD559975bc970906167f718931dd4dded9f
SHA19c19664bfb728804bf57d70fcab43486de9aee74
SHA2560d210980f0798c8d0b6b93acc9ac1197fb73789bc64abe514b6b5947d1e3f35f
SHA512ee765d4070d533927450b3dabf42bb61d9c586a0b29cd160977b38ed9da1d28799da3153fa12a4f72073fe2b15034e5bbee22227cf234e029b444ca54f7a6f31
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB