Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-11-2024 21:26
General
-
Target
2eb09fdc5997dbdcf63e01fbaac13f869efdc0d72f5ea4b2c8e4e75adb1bb64c.exe
-
Size
380KB
-
MD5
72d675b27e9b081c5886b1bd4eb8d6d8
-
SHA1
f817652df98dbfbfca371a1d268297a2d630aed4
-
SHA256
2eb09fdc5997dbdcf63e01fbaac13f869efdc0d72f5ea4b2c8e4e75adb1bb64c
-
SHA512
02e42d379024f59a9392f16931c3fb46804bbca0a5a406ef7215e290158d919f66d7ed055ff2b20fbc0010e0a3dc1ea4210c7be8b9afdc12d17924fefe95d210
-
SSDEEP
6144:vaEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:PmWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb09fdc5997dbdcf63e01fbaac13f869efdc0d72f5ea4b2c8e4e75adb1bb64c.exe"C:\Users\Admin\AppData\Local\Temp\2eb09fdc5997dbdcf63e01fbaac13f869efdc0d72f5ea4b2c8e4e75adb1bb64c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD518fb477a2024a21d910672b4fa3eeca9
SHA14faae25fe6f32146ffe293ec162566f7a8e398a2
SHA256874e8e723db48eab8f65fad1dbff0949be112355b50ded73956269e290a9a434
SHA512ee3534e8609787c479b1b1f64e38d91361d9d7857cc0de8ca3f83e9078ac9f5f52215ad1f3ff653a18ec96e847ebe3f7e62524adfc7ec73f422121b6ec0de659
-
Filesize
380KB
MD54f352c72b76eaddaabc1d56b36b9c70c
SHA13cc9dc2d3f2dc8b8a84872dfc8ef64abc3b973e4
SHA25624b23c036e7297430b60a885177ee15c22fbb8f3036791a89a0dc4857615a483
SHA5127128b77e59a60b969318f875774b5fd991a328b2401777d3d2af975c8b2a0653b77ef08a50f0b672d37bb20c2af8284a4d937b4f9e9263661cb144f30a8d7143
-
Filesize
428KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB