Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/11/2024, 02:18
General
-
Target
b44cc56be8da7065224fad953a1a2406d302da795c7ffc3852a87dc114d983dd.exe
-
Size
218KB
-
MD5
b74f1bc0a6463de450f94e21f70e702f
-
SHA1
17bdf644004b0a541bc7aab2bf03c53554959023
-
SHA256
b44cc56be8da7065224fad953a1a2406d302da795c7ffc3852a87dc114d983dd
-
SHA512
7a797b5c502353f22bd32b11bf84ec7876fddfa9e104dd6bac94895f063cf13c4a4c994cacd1b017d0243e39cfb49852271f65ba423f0884f1960a45a0e0fd20
-
SSDEEP
3072:Ivm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:G1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b44cc56be8da7065224fad953a1a2406d302da795c7ffc3852a87dc114d983dd.exe"C:\Users\Admin\AppData\Local\Temp\b44cc56be8da7065224fad953a1a2406d302da795c7ffc3852a87dc114d983dd.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5150a84f9358ddc598a1c4e13b7259388
SHA15bf2df73118b1160db411dec7d7cfb0f04473398
SHA2560392e44297a8d12ede91301fd9119cec51b710e063234231334ac79cdaf27474
SHA512ca44a442387876465aeaa10db9012debce1086d478e137ee20228c452aedd91ba1a295eee738225931c543bd73d66fc4647843c9fbff58e4fd2f953e676034b3
-
Filesize
42KB
MD503f96837cbd709ab5ea3777fb91eb9da
SHA1e42da2d83a1ff0ea165119f77cf3f5a01da53932
SHA256a061df50b02070a88ea6d45358c4bc0f018a5038dd8fd9735c88c65015478994
SHA512b8d562088aa9b4951670ca2790e774c784d98695a598447043022f5607af9d0d72370025212621ab1ae63745fbe1bae07775b6a49a44e203786f5d9df27a505d
-
Filesize
218KB
MD5faddc55560bee24b9c0f560716784e06
SHA1444f3a38cd3d152397d1fbae8a925f9f4d6d8c6e
SHA256abf58de56aeb1b7dd9092fff7138092f280211adf90d9d65cabaf7cea6b21cba
SHA512d9ba63fa4b5a05b1f70edb4511b14aa692b0ebd8c65fc2bd27a12727e20d9c5c0dc5ead611b11e02a7c3c5453dbd26034f451d9509e5f228d565a5e4eede4b1e
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB