Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
30-11-2024 00:42
General
-
Target
77eb44feed2a80daa5c4445b1d3976efbcbdadd6bc226953072a1dcea9c80510.exe
-
Size
204KB
-
MD5
1aae0ccd5d8cb5683857d1527228bf80
-
SHA1
ed6e36d4f8d5bf34fdc7e547485f331a5ab94fdc
-
SHA256
77eb44feed2a80daa5c4445b1d3976efbcbdadd6bc226953072a1dcea9c80510
-
SHA512
219be367416c537fb805d439ab45e2f41c1d366a1b9e172bb8a8f367e86d82407e70728debf5b2c6cd2ded263e9bfd6d0bb37a6e9757217d04e298aa1beb5848
-
SSDEEP
3072:e5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:eLexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77eb44feed2a80daa5c4445b1d3976efbcbdadd6bc226953072a1dcea9c80510.exe"C:\Users\Admin\AppData\Local\Temp\77eb44feed2a80daa5c4445b1d3976efbcbdadd6bc226953072a1dcea9c80510.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51dc76297f1dd98d1189dda221c788465
SHA117575620bda3083f3f39d1520a7b46e8fb51d0eb
SHA256b3d3d7fbe8b294e1bbdcff5826becb17a5b10dab0e257b15bfbe5cdd53731f30
SHA512e2759b57ad47681dcd470e9f9770ecb136ea8684c844594b4f8a52388b8c2f1df7f048493b3cac18b1e1bca45ddcd90206f91158a075a081e963b0c3b4450476
-
Filesize
1KB
MD5168a69a9a3f850eba3139ac4b9abc8d2
SHA1feef854e18830faf550f9400d480d27f076e29fb
SHA2561daaf28aa40549b2141d4fe98aafb158ef16357e6dfc465052fbc59c7f6aece2
SHA5125450e248e3c7346e6c14380bf5f1cc6fe48ccdac66916f7f5b5d4cc76d29d7eb36516423bd5681565aee693ff287df8ae4f36e3d56a0da5551dd471f1fe192ee
-
Filesize
204KB
MD53ff881243d14679a7538eeb563ebf83f
SHA1979ea77d5c0378be6e2dfb961b66b8dccaf6ffe3
SHA256e0db93b89088283858cafaf968845ff905e89d07717c6b3efff11444316de10a
SHA5121bbcae32af20924c74034d47794c205fb6652e1560e0f6d6d10c0b64f7eaae2421ee6d23732d10154d43949b9e676cd57a7814c76a7ca271fceb2e456acdd549
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB