Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/10/2024, 07:16
General
-
Target
fe469915a1969d5644959037c8c062cb966e5788f2f93d295567a7ac2d24cebe.exe
-
Size
218KB
-
MD5
6930e2011b3f745fed11e35cf1dde700
-
SHA1
a240dc9b32e6c3ca0623883cad1ddee99febaaef
-
SHA256
fe469915a1969d5644959037c8c062cb966e5788f2f93d295567a7ac2d24cebe
-
SHA512
7074c7789c7f1bfa6b0835b65ba9a8de0039764196baa689fa70dce37092d6459d9db8b70ebd42151cc00b89f21bc8de1cd49b7f6ad7135932c6f124b67b50ae
-
SSDEEP
3072:Xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:f1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe469915a1969d5644959037c8c062cb966e5788f2f93d295567a7ac2d24cebe.exe"C:\Users\Admin\AppData\Local\Temp\fe469915a1969d5644959037c8c062cb966e5788f2f93d295567a7ac2d24cebe.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5424305fd32b9e5b586aa123b6a789563
SHA1893846950bf0b2eb6a4d362d7a521097ddb428e0
SHA25610af1cbb3889f6c96560a82e80ed9bf4759f6b82c5db261376fa04610e03d8e1
SHA512bba28a2c016c82deceb394a637775dcab1ec0fe4741d4f80b552a461555d0b3a79cb6600e77236f138449bca3fb1bdde087c60d5612b8b1fd4bf8b43dc578e14
-
Filesize
24KB
MD5d8eaa59f4209e5a05dc4bc247a64c121
SHA1b9d9d2c1294054bed402424e0f80cb8671233ae6
SHA256209b73638736931227d7c1f748680f3a34964f8623e7d8ad9641716a75a8a932
SHA5124f7b829e343f2738196195e613434c844a0fe6de8b6e4bc81ae407f20b553e054926638cf7ad7bed655bcba6b5c15c3cd91ea9fd7d1f6b50e51b21244aa9f8ae
-
Filesize
218KB
MD5bda2e97e1ff54613ad46fb48ea38794d
SHA164ddfaf44e251fd899a989228f93f384bc393a70
SHA2568db6e0c5a5de4a07e6ec7f90057b47d98b773c591e9f8412f43b9a33cfb538ef
SHA5120c098c91f0f00a07a7aaef805e16a8659beb228da561ac8426bc9a3985e70a7b87835f9b49a88d02b56a2efb045ffbc5f34290fa52cddac54e5c0f1b5bf92ffd
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB