Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-11-2024 14:55
General
-
Target
783639a263a804985eefd178dc9dbf9260aa1556797388002a98181fa934c6f9N.exe
-
Size
218KB
-
MD5
6b0622c8b43314aaeadcfbe6fd0eb560
-
SHA1
72595123a369c5b87cb030291204231cc4d7d252
-
SHA256
783639a263a804985eefd178dc9dbf9260aa1556797388002a98181fa934c6f9
-
SHA512
b15117526ac6f2d11ea077217fea17cbef11b956a5ed4e98b4de12cbcbd9d6a3de6ffd63f58fcc6bac55cfe01bd9bfc3b21c0454af7e4c6a0949e304205b167f
-
SSDEEP
3072:fvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:31SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\783639a263a804985eefd178dc9dbf9260aa1556797388002a98181fa934c6f9N.exe"C:\Users\Admin\AppData\Local\Temp\783639a263a804985eefd178dc9dbf9260aa1556797388002a98181fa934c6f9N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fdb6e01b68ecf40b17fbac860a2abf88
SHA12bb147a4e73ceae61dd2c8ac1f08494713488cc7
SHA256063306cc3070714dde762c89d264a5ffce26850f9723361e3c7392e0e61826e1
SHA51254a1f2e0d003aea4330d26fd6741d51a3ba8f0c8ad4463e696471e567d823ec640e870612d06cb5698ef1b000bc21da07b106ffc8417277767839b6049955dca
-
Filesize
24KB
MD54f56bb124079672668cf67c3b01f18e6
SHA1f016f627c712ded00ebeffea5116eb655af53e84
SHA256f12de2b9ef69ef7219a1710d97f5e202c3794398708dba04873f73ec239744a6
SHA512bcf71804524c283bb57ce2f2c03a9a8647ef46c14acb1341ce08b26f32f935ec4a7305800c1080892c744a69e01b9cac39a90fac131e07f4935b9f9cb3768cbf
-
Filesize
1KB
MD59c6595901e08a0909f9675990f6921d6
SHA163f20975e5c2e961781b442ad8c0d0296bad12e5
SHA256257e5b4a730293a76aeaa4ade344fb346b95df233da2e33e7bd63465926afccf
SHA512e6661254f66dd59e1415b6b087a05b8bfd7a23e93362b909edf616e48a68c27ed06a8cf0bda809c26f83029a3a2cff158ad41e53ea1f0f99eecf7396df871ed6
-
Filesize
42KB
MD59c05566f70e3581ad0ba8d9811a4e907
SHA11c58e49d8696743947e9161bf8422aeb4307feb0
SHA256ccc13b06ab37d67cebd4050334dc133c721abeae359425474637fa8d94d3a9a1
SHA512f2b778e4060daa0f2e5a07d384390d472ac012baf22f37ace365b94f9b046e6fe064c0fe309cd9209b3e3ad756966b0d8a7c1d710a6fce52f16b55bfcb7de1b9
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5ef95a56dc09c301988becb0e9b953f69
SHA11475780f354a1be3192aa31dd1c96a7f5dc1a1c9
SHA2568219dfa2d13549f724e155191d54bbeb1c83eda3e7d97762d677042663a5f07f
SHA512b981487c21b718d9c95bd8f65f9f51b06a97a6b5044b6d1a76caf479ecc4a2abb85c1d0871a71e70ebf99d3b7ba3cadac98cdd1370ce3ecacbbd222659989aa9
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB