Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19-12-2024 06:42
General
-
Target
a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe
-
Size
208KB
-
MD5
252b25e9d5964133888342b0b269b020
-
SHA1
b79252c8fcb3a6c94fd520b666f4cbb219b57f6e
-
SHA256
a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267
-
SHA512
f666a9d9f960caad2aa7c1d7c46b800f42d939d58ae1fafa193e60af5e672ba94bb4951197ea2ade5ffc42358ec456c3b79e8af73e03dc11fcea50ac4b8cd0cf
-
SSDEEP
6144:uOYX27lPBA3YDMw4lj6idlMlwl7/79C87:uwBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe"C:\Users\Admin\AppData\Local\Temp\a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cae4d74718b0461f3984ac34b6a4cda2
SHA164cc3e2c9ab4045b95e35a17ffc6deffc0ee74b9
SHA2564e02cd6736f773e81c3e4e5d8bf8ca27160d949d64cb86fbec47cb53c66d9101
SHA512df6303910237165f4c99fda4f4238092e2890e52e8c79edec0ac1ebdaeab9b655da3b17ea4932531f2ee829f97c9a298a8ade2792e174ac1ac0f5a9ec2033f96
-
Filesize
24KB
MD5b51f1fa2cf87271927892a367efc3d67
SHA17bbc7b076fdad06b5fb23cfd56c9df38f5134ceb
SHA256dd36070dc0d6d3e9abf75d773d749d8734370029288ddd70e544620cbfd13b83
SHA51239940b76df3a3231c28a6d5da465b0e68a910f6812b1cd8673e26c1250e3dc34302b70aadda209e1747771ae94e3c3a39c8cb53f5b5439baed32e180d2dd1690
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD51997563e1c988c9d89fadee61d13750c
SHA1c413a12df874a370975478de51fd601dbebf86a8
SHA256377180c6317520f5432afe09ea97e40e3d35ac8f5dbcffc4c91a0b9f8a7bab93
SHA5127310aa30c8bc922add5486bd8e0af3f135f6ee4d641fa094d4d11bbc244ab853c0694bf8face4433c4bc8585cae9b6fc723adb553f25f08b387caff4593ee448
-
Filesize
208KB
MD597aa37477a1d0d7cda1eaa780213862c
SHA1fac35e6d7cbf6c271aaee549b97cbd6dd5fb5032
SHA256a66557425920dae798c511871c278871c3bb8f81824c729d3bba67ed362ac31d
SHA5122b85fee0c13a78b23ace85d7b50b516767cc697a935d5b6f152cdb35259dc3f2887fda7e9bc4ea642363ced777ea285e822de8acb2ed780795baeb500d6847dc
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB