Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/10/2024, 03:28
General
-
Target
a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe
-
Size
208KB
-
MD5
777e60853d32b173bb5446d74243f397
-
SHA1
9af4fb89b95d4cb84651ab0e070411b49fd171d1
-
SHA256
a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa
-
SHA512
fdb2331b18c14e4155c3ed5c40b672fc7a1d2cabe691dd4ef364b8ea182ad25e47c00364f09b531dcb28f965f59f66ff22b4c6e3ddd6787a1c56fb6b1e0069dd
-
SSDEEP
6144:Ja1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:JbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe"C:\Users\Admin\AppData\Local\Temp\a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5cce86a3e9ed25b8abeb84a975619e127
SHA17573a61a5a8495c4325fdf090d7ba255cb3e769f
SHA256a848b7a5bc5d3d4e0bbc921cd7d5870b7252b7cea9557fd83598b7d09b8e2104
SHA5125e1fa793cb500176d8458a880212cddd9fec0b48a34d31ed8c3a66484cde3c3703db2c5cb9ac9d919a604df303e8bcc7aba7f806edc4a3ff0103612811e0e772
-
Filesize
208KB
MD5366d5de8cd1bddd491c4c46f0b6ed00b
SHA1e28578b5685cfdbb800c7291c0cbeabe3fef6711
SHA256a2de8850f212f3aa24adf2395f18529eec363feba517dc4f17d97161d0e5830e
SHA512faccc5dfe9c75d3c11eb076fbf4f5d533a86a809ea4e5956f960fd098e3fe33d8f9d2415b009f2dbc98c2977144839284cdd9a42c1503e64859a0bc2230dbd83
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB