Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/10/2024, 09:56
General
-
Target
f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe
-
Size
230KB
-
MD5
94a9a3777e967eae3dd89b5ce5642c90
-
SHA1
827ef7d402f9cad442d96bb2cdf192ea298e5e3d
-
SHA256
f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609ab
-
SHA512
a3eac6e9c366947061046225369274bcebc4b2c0bd7def8a8a59b1134faaa93c8a48cd52158423085bf7c226ac1ef5ea22c3f7cc9cc1564f915a698ef202f7d8
-
SSDEEP
3072:uIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:zDAWw5NV4EBXWAIT/nw08xTm3E
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe"C:\Users\Admin\AppData\Local\Temp\f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD54c97b653d5fb4aca755c599bd414fb8b
SHA1ebdb23a0bd2e7d791c5a59f79d8f811815994e0a
SHA256576706ed6cb6770f078df96d15dee0412ded93f4568a15828757c71afb289904
SHA5129214e8900ec6743865f363e65a4eb49f3621d0b2e67bd63c0a4f31f0858bef0d282d1bae4b3c884c17471e401c952ac652a628298d54269aae41ad62478a1d0a
-
Filesize
230KB
MD54fe3a1e343a95a6ce5791eb25d9d790c
SHA1534d5ab9688b12944202494bc39c2d9253413fd0
SHA256e69faf1ff8ef7a32d3a11cd8a1e830f081353c8cfff51b9a1a4508aae3bb2264
SHA5126edd4e47407d70fb5df9a5fee82a4f2a9f1e34f218d45e6d6bde0f3165ecc1349fbf8bf60abde2c16a7cf9950751c2ba8653f7d35b47843a58a0d1ae6a5d9396
-
Filesize
324KB
-
Filesize
1012KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1012KB
-
Filesize
324KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB