Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/12/2024, 04:08
General
-
Target
c3056c605cb903dd298312bc119b2e0ad7cc8207ca6b7651e484671ba5f00db9N.exe
-
Size
686KB
-
MD5
42f466fbe9d3a844ffaab4a08a523880
-
SHA1
3219ee3f9ce487b255663cf33d2062f39a8d1f0f
-
SHA256
c3056c605cb903dd298312bc119b2e0ad7cc8207ca6b7651e484671ba5f00db9
-
SHA512
f1cda751f55a1a5f0fe56b299c4c876d5ee6f782c49b0aa495ac6b57bc2b07d1a4e082f0cc299e23c8b56d5dfda1e4063224061860318e34154fecfea1ecef11
-
SSDEEP
12288:YmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:YmUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3056c605cb903dd298312bc119b2e0ad7cc8207ca6b7651e484671ba5f00db9N.exe"C:\Users\Admin\AppData\Local\Temp\c3056c605cb903dd298312bc119b2e0ad7cc8207ca6b7651e484671ba5f00db9N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5464727ed14e1be9b10551bd1f0b2d8a3
SHA110f31233754f7ab08ff84f36ebbba42b60d57e9a
SHA256b659ac1a60efa52763883c623e84deaed8d941adf25449eda914ec6ceec48a02
SHA51281d6eedfd6bd2007fb1d35d1b8560e236ec2d06a308f83c2166621b091d5ca750b6a194eeefb177b2a04922ca5bc2bed916323bba0bcd53c0e7c2f3543cf6e4c
-
Filesize
686KB
MD5b9526e778d472c24a20f8b941f8eee1b
SHA1792abbd7e4195cfce1e1558d8e4a53381fc2e3b7
SHA256d2348bff78617ca49bb3942b912bbbc0aa522170f72ed31e2c76db1fa8652940
SHA512fd7cad79775f1b5e578c62fb963ab166e514214cf59ca2a072e033d6f04abf18e964df3e148d9fb43e648077a732d482d8536cb3975010f45fcc8db45447f620
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB