Analysis
-
max time kernel
129s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20/11/2024, 23:12
General
-
Target
5a12e622192274e80142c2ac4e98e2fa1eb0abc7a2188994115932cda056c77e.exe
-
Size
375KB
-
MD5
7464d9b4c3a01d46a167d6b1f868e2db
-
SHA1
9d4bbe860c5d145405a22a59d1e2c8cca63b4340
-
SHA256
5a12e622192274e80142c2ac4e98e2fa1eb0abc7a2188994115932cda056c77e
-
SHA512
b6bc849b6a6b7efa15b4a4630e7d7634f350210e568461be402f31ff38c7f8c96d21fd07e6e7f576145d6ec4ca092a70ba33500e108d41755ee39e67f73b0dd7
-
SSDEEP
6144:G3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:RmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a12e622192274e80142c2ac4e98e2fa1eb0abc7a2188994115932cda056c77e.exe"C:\Users\Admin\AppData\Local\Temp\5a12e622192274e80142c2ac4e98e2fa1eb0abc7a2188994115932cda056c77e.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51693c9d15dca49052c6708b253b815bd
SHA1b57b9df7cb6a11566018d93c15ef3ae427e710f2
SHA2569322f7637b68e71fabbe50d378c0182cfc350e7a6092783407ea391675a30d48
SHA512eb4ff3039fbe3ef11a2f348495a56de605522e8cb19bcd352066a674096146286597f5d16698d02320fec2b11d119fa1d9eae7ff440fbf578c6123f1a28fe9d1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD5ad303325a2e5b86fde4f1f4b3f449191
SHA1445a31f593d4ae3861f5ce491d2f5135b854da64
SHA256ce1bd10417e78b964b74855f1195a462f95f60fcd084c9608cc635bcc7c9e7a9
SHA5124affcb2577edf1eb98adb68da1974ee6443d3ec1265229d66d131101aa0454d187e977d97ca12015f5772c4472029fefa46b86c8eedcd7bf6dd6590f1b6107e5
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB