Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18/11/2024, 21:14
General
-
Target
1f2085ca8c01565245e6322ed8776da4e8a8286e306776e6ec8faef3dd12de4f.exe
-
Size
375KB
-
MD5
a0a99edab1e7cf4f9460c848e81dc7a6
-
SHA1
6d21b8a42de64e2e5bfd664de6ad390054e91fcc
-
SHA256
1f2085ca8c01565245e6322ed8776da4e8a8286e306776e6ec8faef3dd12de4f
-
SHA512
863034a61a876c3a4b474d4bc2a8e4699cd2b65e0d4f95304807beb5c8bd51544bf2c772dd28c4248edb58aeae464942405f77c72535cdac878961984cd4442f
-
SSDEEP
6144:e3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eis:5mWhND9yJz+b1FcMLmp2ATTSsds
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2085ca8c01565245e6322ed8776da4e8a8286e306776e6ec8faef3dd12de4f.exe"C:\Users\Admin\AppData\Local\Temp\1f2085ca8c01565245e6322ed8776da4e8a8286e306776e6ec8faef3dd12de4f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e001499095d72f3ebf49e83ee6ffa8ce
SHA1cef8a80071abc345b875b3faee331973ec4b754e
SHA2563fd6ea72910a2214d1a8c400a3f87f7563c8e3cf34d7c2d15c556885932ae6c8
SHA5127ef3d2ae89a6fa593eea9ffa2c9665adfe035bdf37164e28db0c898f60620d4af76fbf86a459f0229d4d9ea93916873ebaa029e871b54c858806e4672cf8b048
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5ae0dd455ec3f2cf62586b36e9a52dd70
SHA1fca69668dc2af90f2d4235efaae9faa883ac4b95
SHA256c2c1e17b01ca6f79e125620b43f332a7317b0baadb7551a710a955b851278d76
SHA51211b1cf197654470706c42b101ae54f36605255445e7ec89d83492660ebc2501c987e7f03526193a57acb85c329f89ea6c0ff5e99e3f7d11a3860be303efbd97f
-
Filesize
1KB
MD5dc89e0c302d7c3d4455decdcad897870
SHA1116ad5cd243363b5a20d3de017de8b28e962fc1e
SHA256302b61bec15f277551d63ef592ea19d9b17bc45a6067a021e20568dcee29df6c
SHA5129e942a27d9ae3050d1d86d1438ca1ea5465a8b65a8458173519e6d176e517e92a6942529abc14a2dea198117b52f7bff32ab6c00cb55bd8aa2cb4039b7e8bace
-
Filesize
1KB
MD546ea131ac4a3292af1e11928ef9c42e1
SHA1670d0a89678c2f8586a9e4174bdbfaa12aff4fc7
SHA2562faef0f7963726c9d59a4e95add9e2f181abcd5369bdd0a36faa1b3174b796e1
SHA5127dbcff24aca3a1d6bb5da95f489518ad3b299e3dfacec934e0f9b190e11938f0526a0ee875f4088e92da108e58ed0d2922a557dd4b0146592fafc4f207142b16
-
Filesize
375KB
MD5e0d80521a1265c32ca47ec3d352f1507
SHA14e1f5c935631aabb17a69549289fd6f3430ef9c9
SHA25680692d531e909b2bf89083874e0a6595b9e81069b6c61f1821aea6cdffe59b3e
SHA512e9412cf820b118a05a6719d20e577b9b4b8aa988dbe7c0863c3f4a4f3401e31c82d85df29754c7992ba7feaf34021541844ebd4f1ec046798e91c8b13e4bd211
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB