Analysis
-
max time kernel
112s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-12-2024 03:00
General
-
Target
1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe
-
Size
217KB
-
MD5
0a315e017dc1f7149aa1a4642d7cff30
-
SHA1
5cd4346a417c08d47bc5209161c0772047138ac5
-
SHA256
1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039a
-
SHA512
f79762b0aef7e0e4222eb6bcc7b53e9704419cb92dc8be94b9ed1ac67791bf07e6ea46798cd59bc26a10fecad6392c31fd46779da31e6f31b6bae85fb32ea394
-
SSDEEP
6144:IrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:asTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe"C:\Users\Admin\AppData\Local\Temp\1e499d80be9078b4f831e59ba6ffa4856ea2bbdd9d3bab9fff6f1ac8803a039aN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD527463c5da7e90a84afea2b65148d0d16
SHA12b9e99c559fe5a66c7fa61d8901ffcb949143a56
SHA256b371bb0c813aa818352ad45d93d537c2885f6c43d850542911c098d23ed25488
SHA512193d5afceb4746ef99a9775ab33a7a6f32301775006a44a31050befe1603f7a1daed6fe88b75411255213e0d5206fa580d9a10103a3bdf4a917a6df22c0e4f98
-
Filesize
2KB
MD597739399f0f7bd345de395e0c42c79f4
SHA10c5aad8f0a1a23b1b1c709a0a4b283738cff4f1a
SHA2564b20480c6953a43e51abf742b44e45ac184cb8b14e9808d254d486456ff49d25
SHA512c4bbe517a24032d5483173a3f2626f69d98fa5fe5ffdba4f47d87a7f1958f577a558ae43e0b92d07c63dbb018f4fd9cc9af6e23792e59ad19dd157719385b0de
-
Filesize
217KB
MD5adcc5ff9bf9d82771861affa1e23b2e8
SHA1e8ee6d7dee72f478ffbfca755ed76395daa40d04
SHA25607b19377a153d190026f155e7cca6ddba1003513472112eaeed50e72fcdc3773
SHA5125b452d50b1bcba138fde12978dbc2545311be7d176e56bfa454ae9946acced4bc1fa28f676b69ecdf1ecb4293f288624fc6754711e8354398ca855002c2479b3
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB