Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/11/2024, 03:08
General
-
Target
c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe
-
Size
355KB
-
MD5
1c1b6dcfc35d55330d6c739a90ef7335
-
SHA1
3729f9fa7e25a486fecf14ade10c15fb8f2ed2c3
-
SHA256
c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381
-
SHA512
84af56b97f09d6b19037f5a9e3bef9120c2cb54c3008cc942d494ae896838563d8acb9b0f8ee6455d40486a9529e56f09033386f32eb02fef1f1e155043b4d71
-
SSDEEP
6144:T3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eim:gmWhND9yJz+b1FcMLmp2ATTSsdm
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe"C:\Users\Admin\AppData\Local\Temp\c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e2103bf8af6568f5caaf7c1986e3b9db
SHA15c3a493ea047e75d73363fb00abf154e446ca20e
SHA2568df405ec13a91d9d12ef65177c3469f5e56cb1a863346226b5e3bce921c9f27e
SHA512d5971d4ccff7efeaf761bd90a6fb43d95ad8de52b0834d31e118bbd14e54d9513a8d4fcd62afc702c0e0a7b8de6c09406da19faa6c757850b97249a41422c6bd
-
Filesize
355KB
MD5c730cd15658a5fa5dc4115e64a91cd89
SHA1400334fcc62f00a537bb1c806c5f5b0f7f11ee92
SHA25624d44826b158d3558d5d139419e0b02233d234521ca84c076d6cf2b23cab897b
SHA51276ff274c6e0e2fe88c41f6fbd5b9e2051229ce35c73f101200059afb5ca3f0b31381b545256f0330811115b14ee6f89dbd5317c737eec3f5b4f9a571afe3493f
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB