Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 12:02
General
-
Target
ff0ee78f53549b6f3100ab0d9a4da18cc72ae5cc9bc20599693fd9aad884e3d1N.exe
-
Size
218KB
-
MD5
70d7d0cc9a7f0c2015385dbafa248170
-
SHA1
f8cc749e5808f5f174c86469e50e956e88522b33
-
SHA256
ff0ee78f53549b6f3100ab0d9a4da18cc72ae5cc9bc20599693fd9aad884e3d1
-
SHA512
6d327957c6f072768a99a0cf09072aea46346a7638e706f6cb2c6229bd37096ed13a843de7790eee8f464b5fc30daad9b10189b92cb70aa42054f8ea96bd0916
-
SSDEEP
3072:Avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:u1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff0ee78f53549b6f3100ab0d9a4da18cc72ae5cc9bc20599693fd9aad884e3d1N.exe"C:\Users\Admin\AppData\Local\Temp\ff0ee78f53549b6f3100ab0d9a4da18cc72ae5cc9bc20599693fd9aad884e3d1N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556da2dad0cc9cf73fb1d02aa0ae03723
SHA12d5ec95a25341cf061a4633fa432eb79eb9750a4
SHA256fee96ece85d4777a0363a4093f5137979b94fbe8f2ce2146b4b56a611d55f29f
SHA51275f2575b0b423d8d2456f2d36c50846b391bfd368ffcc2098431a8166adc1996355abfe946f24fae5db56a2a85d80fcc446e7c5439156e77a01dd400f1a7ed5e
-
Filesize
41KB
MD560a3fe045e53e01215b2d4c8e025dd1a
SHA167fd37adac31f7dc04c8665cb2438867bd64aff8
SHA256f2cfd8f723acc244cd50f3c1d01866055c2643f3db9ae22f39a47d723d2e4dd4
SHA5121add9b52aecfaa12cac33b61bb3b28e413e74f3f839ce135937d6ef575902c23b358b607ea2192a88f470d12321ba56caa708b1d184a2b5da9486c5bf26c1b18
-
Filesize
218KB
MD57dd5ef7612d5a902bb29a3f6745ecf9b
SHA14a223d2a9d3173e84a54fcc287eae9f42595d7ac
SHA25692174c3144016c955536dc49c706a650584bebf270b1c4c8215838e486a1d00c
SHA5129b520dcac66e6a137d9340b9debbc8e7d02a19a3caea56ae442247119f0d2fe5e407f4e62c36e0f0e79f5c0667faecb3a331a36991d14f277ac0486c026895cb
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB