Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/11/2024, 07:44
General
-
Target
9a65ba1745e1af15a723d3a0f52a042d3f02b81bc45afe78e2b15df68ff9e065.exe
-
Size
218KB
-
MD5
57ee16332bf0bf319230d8e903c9dc93
-
SHA1
6c43277322cd109c51f645bdec3a2c41de82e135
-
SHA256
9a65ba1745e1af15a723d3a0f52a042d3f02b81bc45afe78e2b15df68ff9e065
-
SHA512
1073ec1707372daebba721ea731948552e16898528e8b79546b759d0b8a8365d44ea3bc43b3c043a78810d727063da60f9f34700dc973fa8b69367dd90d5b5af
-
SSDEEP
3072:Tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:L1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a65ba1745e1af15a723d3a0f52a042d3f02b81bc45afe78e2b15df68ff9e065.exe"C:\Users\Admin\AppData\Local\Temp\9a65ba1745e1af15a723d3a0f52a042d3f02b81bc45afe78e2b15df68ff9e065.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510c1cf5c93839196ec632fad7da75e7b
SHA17008bd40586c3be139b6f3414489561bb2b5041a
SHA2566a4b6af0c04c88307b3f3e65bacf694122a95f37716d85d23229ba9a76086c21
SHA512c79222daaeb331e27c26e8d682df1b78f3097b2239c753503b9f6088a298d59146ec285f3b3b4a9f19eea52395aced3ff2c9e8655d65cb3f6530bf8a416e560e
-
Filesize
218KB
MD5b33f48e13cb1b480f2db86ef7514e98c
SHA160df9789d1b9e6eeeee3888ae6b8d904fc019dab
SHA256a6532e190ecde58aff40b73c54b31a679bbc2893ea7f6c492fa14405aaa73057
SHA5123ea9131f80ffefef800fc97d823e7558fdb8c25721d0c51dab10b74d348b02883a28aafbf83d079cedd5edda8433cd2897616b815fdd390c400e7600d55b6267
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB