Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20/11/2024, 04:08
General
-
Target
d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1.exe
-
Size
218KB
-
MD5
55ea8c0f6d3622494b44b4335d31b145
-
SHA1
2633d874518085928c761c6aacf4718e3349caa4
-
SHA256
d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1
-
SHA512
db6cafdc1a5a1033e214da9fad2d8e3efbfe78c6029462fcf63ad3e5e0f381be3e65d2b59438d85ab1bf0eec56302aa46a0ec0c8fe38f239209df30798a239f8
-
SSDEEP
6144:yEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:yEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1.exe"C:\Users\Admin\AppData\Local\Temp\d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f4107ab2c36e039c64ecf1779904b987
SHA10583abe6f445e0422892b4e13b45a36a26304ca3
SHA2563abb6dabdbc4fa193c8799bb6410d034ee84be2ef4710b93d6c2bc6daebde21a
SHA51252c3ba84f28c1639790408ab7334bdb53070f3e16a7bff060f3d6c23205e58fbb1921699310191a1ff2cc13b88456af932eb7a826848d7d060b2caf0128bf57e
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5e463d94723dda5b84a35c9652ca4e910
SHA16d40e39a2aad9024df8fe774b23112f64394a324
SHA25693dc650cf3af032ac667faa928f99b0208ecf86112d8290f7e365c755505318f
SHA51234672e0d4fe0bafc05e94f9c6eb4c7444ddbdda32c3ed1de5fa63cde7cca50cf034d086d3dc1568b10bf531d72716d7c710c1db600240752308afb04cde567f1
-
Filesize
99KB
MD5878b7bb5e6da718cd763124a2dfeb522
SHA1bfa59bc4cd05888bdfafd42e8a45d857a9ceba1f
SHA2568afb39fafa0807fd5e525d3f7f1a97800396c4419f9ac1d0e419816ab54b3f5c
SHA512b84689b4055b4757410b60ca999653ffb2b971df1d41f4dbbdc69370da5f9d22b164eed8dd802f8f917ce4857f840be833f1de6c6153a38a1c9f67ebcf9abac7
-
Filesize
218KB
MD58534d8925d8f1e9e5879eb880771ba05
SHA10f73b6ec68602d3f719b99f479e7bbd23c5cbc28
SHA2564f40f0bdeab5364edacb97a7b7f23c89edc6e2a1b0fbea1e55667760456fb75d
SHA512582fb4b7ba5ee8690687e1b0ffbb75043a58381429ca5d361058b95b669481b9f2224bc24fe68eee9089b163508d48907d7d66c68a09e2c6855ac70fe7885f37
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
2.8MB