Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26/10/2024, 23:34
General
-
Target
a0978826805cb0a749e6e833998eb9f0a586d9a76c356b395c6cdf6d9c7bf681.exe
-
Size
208KB
-
MD5
6a6ed4d736171ed315642c625ee28041
-
SHA1
3631203042b1eb08ccb5ef45b285c9dbdb1467f0
-
SHA256
a0978826805cb0a749e6e833998eb9f0a586d9a76c356b395c6cdf6d9c7bf681
-
SHA512
2678086ef0180328299308086f8e0c68a192eb478fa767cd29a5f2dd4e2b28e8363d0d40705d4800e775d6eac24139deb1223155009b3918c6a6884ee2935c21
-
SSDEEP
6144:Ua1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:UbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0978826805cb0a749e6e833998eb9f0a586d9a76c356b395c6cdf6d9c7bf681.exe"C:\Users\Admin\AppData\Local\Temp\a0978826805cb0a749e6e833998eb9f0a586d9a76c356b395c6cdf6d9c7bf681.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
1KB
MD58786000a9622ff75b5a7e702b501fdbc
SHA101817389edc2fbf17a59beb33f0455bfab7d830b
SHA25680055b043e698ebd2a415fdfb1c7e04397bbae928538c71b87521eee1f4b9515
SHA51289745c81755fdaf53ede97a331d4083f798cf1915acaa1d04ef85b5f2af3bfa47a0de0f09a665a3b57aeb6ca0e95856e94d511f9ca7e104a3772601649e07eaa
-
Filesize
481B
MD5fd67538356187b537cc6e468c0951743
SHA1603b0b523360c55187a2456f00575e59ee9ce99f
SHA2569d52af6e3c98db590efe5b2029815127e78052007718aa7273084be5af59289c
SHA51221ef0a16947aa0ae22d68fe7a3cfbfabce88eb89061304fddabcc9c1703033744cdcf8abf298b1f264dc2dd8200f72f7325ea72620b25a482c67cd31a90dd8cb
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD591332e66480151a0e2768949fbb7fc58
SHA162c2fb494d20982d94187ef72b0b0b04b02dfbc9
SHA256ea1d2c350cf055f7a4c143346aaa36099b70e8cd1db9a36327fd9ba91895f050
SHA5128fb70af27e6acba7f0b8a5da189333dd81c38e926aee2b127264dd31d897df2381fb69fc2fc96c22df3ae7f1ffc25f18814bce830c7cf84e7ddb64231c71a850
-
Filesize
42KB
MD5025f82cb10ba99e234dba464a27f7fba
SHA1903506ec6e3bb393a35963aed5ab00589e8d3a53
SHA2560bd9b69be1ff66a55f62fdeb4e80b1c68e015133e3999ee4c285f643e930888a
SHA512de97e5413c5ce3aa7ac862f6ba82c36615690f0d2f01f2c63f70c8935fd3fd35ff8a0b50f0d1bd26cae7ec23a8f4abe38a1e128c5976d728601014055bfed55a
-
Filesize
208KB
MD5f42ca46c0f4c2bae0cbe52c8e7ef30f7
SHA192ca2e4f0c6afd4e8f84b03688ca82c93d3b1bd9
SHA25631c849c256c3b27872ae9eada25bea20ac60289233d736abeee65e0f5f49bbc6
SHA512581f0bcb592deadedbd7bf0cd3844ea2c07a23ac6fd9e34b7d01e30862b82c3b115368793c98646aa5257aedac16d4c8d5b22a1b31a18323e51e54cb6832fbe0
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB