Analysis
-
max time kernel
107s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 07:24
General
-
Target
9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe
-
Size
355KB
-
MD5
b49ba2c90729d59b0218d2141bc2a7d0
-
SHA1
b031db8cba34acc7267de022ee2888c7de0e6e4f
-
SHA256
9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6
-
SHA512
99ad7a04f01eec135583f2d3fed989efa3d0007952a798924685fc40a911f72400cd0e94772d8f42467fa55c3727b62142d1b014809cf1b9f1c405f7324794f4
-
SSDEEP
6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:emWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe"C:\Users\Admin\AppData\Local\Temp\9ce951b1b816ea7e2d1e8eed3b5dff1c3406ae04b3fb0fb378edfebbfb3dc4c6N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD526dc0f7a1e3748f1cf1612f2fc85132e
SHA14a186f1dc617a4af4e7a3828b63c429ff0e09c33
SHA25692b7bc449dc2f2b18f1e34dbbacf726053b63a7e1005135f175982581718c3c4
SHA512a31baddd1feb29ff54eb380f20df2ef2a809be735ec7eb7199314b82e152e70d756601dc465d2f41e9367d306a959583fd49e8c1bbd076ab3013af78fb23fcfa
-
Filesize
355KB
MD5d21142da15694744805fbcaa9ee1a76d
SHA117e43115cf0f40d7ff70ded74fe67623ec59f2a9
SHA256f465994a88d0c79d48cc1b373800180fe19b25a8290da1a55212ace4fc0d75a3
SHA512e416202f20544cf585c4b74be947132c1cba58e289754cd1ff0a987d1f21c435470311e445a4d1846b04b9b59f9f5f0e346cae4ef06d4e28b816161c0d52811a
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB