Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 22:05
General
-
Target
233e410f92623b0c03e982cc1addd93e20e50fc190e1206459f8c00661fa742cN.exe
-
Size
218KB
-
MD5
d0449967f91af95dc5cb3bfffcce64e0
-
SHA1
9f71ea697e9a9ff50b63b49e70810f99d30726ef
-
SHA256
233e410f92623b0c03e982cc1addd93e20e50fc190e1206459f8c00661fa742c
-
SHA512
75fa6fb5d13ebb51531623b02f42e5691d95acb98785899a2d96634ce2c1d32b48ae5e89bba00ad48952295b0eef18a4e5529e3632b7fcd75f0f9652b255b656
-
SSDEEP
3072:zvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:r1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\233e410f92623b0c03e982cc1addd93e20e50fc190e1206459f8c00661fa742cN.exe"C:\Users\Admin\AppData\Local\Temp\233e410f92623b0c03e982cc1addd93e20e50fc190e1206459f8c00661fa742cN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
42KB
MD57100d350ac15f26ac85b451d70513268
SHA1e61b2957284715a4a92e51ddb7d34b3adf927203
SHA256e2c0967734bd90d8e0d259683ef9e44a376139d17313d50491e9ccd717a80b9e
SHA512703781ce958d38f7eade72ea1d94c5e28778b4588efd73a58ac3e3e036630a78fa019f892fdadfe336fb6f41841c4569ea4ebc2e7c3563c86a45b7162ba9304d
-
Filesize
1KB
MD5c2b6e7e81993b6b448048c6fb7f48aad
SHA1dd941273885f0161321077a0d10e9c6377bbde2d
SHA256cc4098babeba8fa0eb6f10ae7a2f5c942b1167c5f0688351cbd5202b03708bbf
SHA5122937c5b2b02de3ab57257e67e0373355f7b33107caf9809eead74ba5e1e898e0e3621d0baf5d1d3824ec7ed775a08008102750b08765d9e0ff2726516b68946b
-
Filesize
218KB
MD5945c88b9b10c02aa9b5e403bef377a8a
SHA1af32571d24c7c062954cdd81342f2ce0ab46a407
SHA25655107ed4a9b6b8da6e29795ac6c52b85f58e49044129fc47c5f44e0d68b9bce2
SHA5124d4001a03c4f0f020cae24cf12eeba1d92528443a3540d9778e3f49f4ed4bac60744e28c1b63eb3ccbe2d0e495c10e0eaf41b1d8a9fe33105117c8ef78b7968f
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB