Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-11-2024 21:34
General
-
Target
3b46950507bb83ade8575cd019f5177e44586b7e6babc67621adb4e87c4d76ce.exe
-
Size
218KB
-
MD5
4c9c75301e63f1dbb1b206b8a53bff26
-
SHA1
f9729dcac2326fcd7d16e976710ed3140a9f90d3
-
SHA256
3b46950507bb83ade8575cd019f5177e44586b7e6babc67621adb4e87c4d76ce
-
SHA512
ac4a91307382a610766d40a5d6cf8ed59becc988b60706e7c66a7865a9e0e38b3c6777794f58e1783a2496b2e471595917b13ede0f139f24daf00d8ae56694c0
-
SSDEEP
3072:Yvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:W1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b46950507bb83ade8575cd019f5177e44586b7e6babc67621adb4e87c4d76ce.exe"C:\Users\Admin\AppData\Local\Temp\3b46950507bb83ade8575cd019f5177e44586b7e6babc67621adb4e87c4d76ce.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50514ca76475ce25379603d905c279334
SHA141f7609c7bbe602f77930ba0ce95df9647d1c56a
SHA256c5c841fb31f6ca19607554ff28cb84ed988daaf8a9d05a94bb18b7d630914362
SHA5123ab053dc272d83f6f72597f8360026fc6e164dc33189343a973a33c3ae114ad7d043f0a2792bcc46efa439fbf4900e43d9eaa437e3823ea4090b6c2ec902a1ce
-
Filesize
481B
MD5fd70faaf5a464a4cd4122756776c875d
SHA14cc8df4993817fe829c51045c36a0ca4b0b818d5
SHA2568879ec02ea6069f340f97b73b8d0211b37369c9af5b048fb9377730e5cf6fd03
SHA5124597ad42d47b0892375565d6d8701c80d72a094a72124960547138f9aba43e226107f17a2a4b4d9679c73ef15abd26657faf0b5ad5cd50425f49bbb097a5c4f5
-
Filesize
218KB
MD5e94fb47c833ca2f3b17c13b800f91229
SHA1e4a2e474096341db68aba8a5e0771e652438336f
SHA2560eab947da82eb8fb1b94ca8e6f701b1f3bae2f17c710503e25d7822e5617d77f
SHA51218da7f50218bf6b616943a137a8ce312a031bf70c51e4f1b598a07a06ea09adfc73f9657baf6d9d8f64fd08cb909f3192422fa664931eb9f06e1a0c3f6cea7d7
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB