Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
30-11-2024 03:51
General
-
Target
26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe
-
Size
686KB
-
MD5
c5d4e3780e463999211f6368d99f1980
-
SHA1
aa1c5134af638f9dac3cbe09061dfe012f3bcd14
-
SHA256
26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6
-
SHA512
0b1f8a890df364aa6677c424b15f2c513d964a5a5db7a2639249d163767f6a56ce483f504575fcc6a65491c71666180c7083a09d0ce70269fa8ef5eaf9dced66
-
SSDEEP
12288:SmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:SmUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe"C:\Users\Admin\AppData\Local\Temp\26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD547b9ca6de534e1614c9eb060454e8ad2
SHA150eed9a3e013438bd5b13f8a616f36b5f7095285
SHA25663802f9d98747341cb858933b2f50b397f96fdf0166d32578e15f458e055a7eb
SHA5122948dd787fe0bc78024ccb17ad42e2c2ef44b8f0ba52cdb2bbbdcb027d0741972d9c42540af5a6e8c9d976337974f7d8449110503692580fa5ab133c261e8bee
-
Filesize
1KB
MD589ff3f6a5043d422e39c8a4f3c00d25d
SHA138bdb28e9717254c562af677f72455b5ebcf17e1
SHA256f0d4470fcf57bbaf4de570bce37848567edcc0b092bb9ccfca669664c910c231
SHA512f551ecc2dc9375acd42911c54cfd0724927b265eb319469038ef8ef08da5274cc61a3d096c7dacff97f918fd4d19badbaf5a470b4049248855e485c9077a0b7c
-
Filesize
42KB
MD55654bbe5a1bb29e4da29f0f830386fec
SHA1ec54b7fceffbd985126dddfb216a101c97370261
SHA256d44d42925cddbf2bd1d15d1e9fccf7140dbb69ee77a2fdba95d8fe32bb401074
SHA5125d23839d9e76c0024ec9147f28881bfaec178693a1bdabf176c7ffbe3064f85066c3d7d04f90c276b69dc1c39f276c1c41eb3dc04be50c2947c905aea0cdf461
-
Filesize
481B
MD5c0a449a47340627263bb8733d05404a6
SHA1e7151e2d7f7ac108499c987ad351d1a7a82fd07a
SHA256d56a1efd65b29d418b2832ee79a5031e259e589beef8a315f3c02c30c9156077
SHA512bf0dc0623d259c9d0bae7f860c7e19922f759eec7c6b1398d04a88bfad3d4d50c1957d58d12df6c4234cf7d6630e05acd3b9dd2d108bc3b2a20807f63891bc1f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
686KB
MD5fcca96c55a2534365ffd7bcc551c8416
SHA190f46daa8421dea92309de5947ed1f9d05502585
SHA25645bf13a521fbbb29ebfa78b7424a64f95b147525c853d070abad7133bc722636
SHA5121f5f62095e84139c4311a64212f1be32646254d470ad60045554bc8b6268b972f0ec17cccc69b6bb5cc62c887b71841677b09f4acb0d2fab6b70d3a5a95419ac
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
732KB