Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 06:36
General
-
Target
667d33876c66ac7fcd2772b899e461cd94ee3777cc4875f74a4041cc9b2cb009N.exe
-
Size
217KB
-
MD5
5dd73b9cc3dfd6b3b9bbc4c5849899c0
-
SHA1
da8a41059892552dba8d839b51ca842d85e471ec
-
SHA256
667d33876c66ac7fcd2772b899e461cd94ee3777cc4875f74a4041cc9b2cb009
-
SHA512
338ce0f5e957ff31c8b90aa4b0b0979885d417e7ec93a00efa10a81cd599bea92bec34fb55c54a0889046da119954a56551ab4698502c2b8a22920bae48d8b53
-
SSDEEP
6144:+rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:ssTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\667d33876c66ac7fcd2772b899e461cd94ee3777cc4875f74a4041cc9b2cb009N.exe"C:\Users\Admin\AppData\Local\Temp\667d33876c66ac7fcd2772b899e461cd94ee3777cc4875f74a4041cc9b2cb009N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fee5778d5b3b7d4bcd6ec47c9d3f3573
SHA13513c3175e008c96a3e1af61efbb0c4f4d489504
SHA2560f6923e9d4cfcdba0d0b11bd0302a8e02f3d86b91b4c85149bae86c7cc4e58eb
SHA51214609f48aec7515d15e0c9d6d0770bf23ece8364f7a5de8b3f520439d125a6ff272f6e14f9889d4c940fc69d93e8a2b52c5fae76a82c0bb1afec29283ccd788b
-
Filesize
217KB
MD57c5d94a34a4ee4aa00a3ed15b8565176
SHA1dcde9e913508eda6c772352a044989955d65e717
SHA2567187755200e35f8fe2e268858f3b58f7a16b6d9e29429154bd8dda5452d7bd97
SHA512ef2b49f0ad3a7c55b05523d30bdbbbd48c4604b46a7a74e5a27db62af33aecb3ec6414d54b9fd4fe7b58e79a27697108cb07c70b705f9ead73c46fe04db03e04
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB