Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19/11/2024, 14:48
General
-
Target
eb7251add7c075c7cb69b26ede096c04c9a230e790fff385ae25ce6835485c36N.exe
-
Size
375KB
-
MD5
3ad50c40437bb87d2096e10a1fbf2430
-
SHA1
6cec6a4648d89170095eee2dbcc498a7e8be7d22
-
SHA256
eb7251add7c075c7cb69b26ede096c04c9a230e790fff385ae25ce6835485c36
-
SHA512
bac84d75158393a96233b74effb14a76536d6d86bc2d696fb01253e7b90db938e367c57898a541dfb3740104e954081db7d02ec9ce82e3138ec8fb7956982991
-
SSDEEP
6144:e3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:5mWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb7251add7c075c7cb69b26ede096c04c9a230e790fff385ae25ce6835485c36N.exe"C:\Users\Admin\AppData\Local\Temp\eb7251add7c075c7cb69b26ede096c04c9a230e790fff385ae25ce6835485c36N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51b45ce673c14fc298f133e5cd7be220f
SHA1c30de2a18e7873c1a74df5c3f314f6593b6736ba
SHA2565d3906a772888e3345579c3bc1270564b76d0872277c18c37ddc6fd861a2100d
SHA51220ed8951709acc7b905f11edf1a4c41e2008bf4cd30b48ee24510df25363fd4039396407b0217769370766ee4ab5444e225833b60214fd444209da0a877812b4
-
Filesize
271B
MD583eb358d93a58a5515d37544731c6c51
SHA1eed72863382f3f9845dc020dcdcf4c7656d619f3
SHA25632d53f571a785269aa1d589299b1e02697b49130cf3059e8071a08a9a946b67e
SHA5129eeff293218d0a5bee5932473c582d3eea21a20dda4afb0d44df38831da01a62eafc41fa1f15ee7dfb18379a4ef4b0327d88a78ddff270c8714245e64c88e356
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD5a09ccae0f3a2363aee886ea33b79d1cd
SHA191079bbebd2d7eca071053941e9e12e51661c41d
SHA2562ec819a74a17b3d74ab3323af52362aebad753cb5b62ea6782f7c972c8e05aa1
SHA512f183884adef5a47bd5151fd33a2afc4e54512a86e01dfc8daf6fd621893549f0e4f40f7023d33213b4160b364c3a83aa1b764ad7ed31fad84169601b25702c2f
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB