Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 21:02
General
-
Target
0e3d80c9ebf3a33fb3aaad78b7916c3f033fa17983c407b07f995a13b16d8cd4N.exe
-
Size
355KB
-
MD5
9963e7835ab552c320d704693c5f3be0
-
SHA1
47e4f3eaf0971ab268c6ee476ee78e633f30c959
-
SHA256
0e3d80c9ebf3a33fb3aaad78b7916c3f033fa17983c407b07f995a13b16d8cd4
-
SHA512
e78f26c29d119dec00f73945a2ee0fd639fb9966727506103a76c3213b7024119eca4180fe9f551a5fc86149b276a99aa337634d48584990288447cd30ed3fbd
-
SSDEEP
6144:5gEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:fmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e3d80c9ebf3a33fb3aaad78b7916c3f033fa17983c407b07f995a13b16d8cd4N.exe"C:\Users\Admin\AppData\Local\Temp\0e3d80c9ebf3a33fb3aaad78b7916c3f033fa17983c407b07f995a13b16d8cd4N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD56144c9f3efa178c34570b2c140f2eea6
SHA10f2e763b11321ba2bd0dcc235fd045b1d49ab19f
SHA256ec88a43db36e7a45dadbcf807d8b2b00fe7aa2c31c7f72d727dd10e7c23a3470
SHA5126ce27237d583f9a6ec3f0b03582a1e62c4c031fd71d45da74a68913964d8fefbd1fc9f290b56fee0f20b2ac8e9c412224bb71a8663fc106d514bc65f3752bc33
-
Filesize
1KB
MD521d09618e5cb27e3b6b2432e75e5bb6e
SHA1cb79b47fd11bd64f9fa5a1e47c431e87e1358225
SHA2561a742163c620c780e7d08f02c46cfc414f758ff9e3c0ab03fdd84cf4324ad11f
SHA512e357038ef4b92a7df865579c3faab28e85dfae8675cb75a9b82d2cd3e4ee55301396edf0504136e83b0932c3545bf25d0ad4358cd1911a5bec042dfae2b450c7
-
Filesize
355KB
MD58d6d51b056d90cb74922293c04b4e128
SHA150a26951111c77aaa6d15a5bb71f214c85313d45
SHA2565243cd893fdbca50b70db17f86ccf7a4964b93ae750c0990efb79b1237b5bc10
SHA512d13ee98371dab3d0366af9ce5d89c82fa75d8a4d7c046f62932ec0f96710a871854dc11f622e01a53a3cfb59221d72c6b5400ba7ddc804b4ff98642c65394cca
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB