Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/12/2024, 21:03
General
-
Target
3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe
-
Size
218KB
-
MD5
cdbb07b5d36b902e9e807847c0915fd3
-
SHA1
51aa02173d3fb66f9ce7a8e488af9657159b039d
-
SHA256
3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff
-
SHA512
72c588513288fd531c06de876bdffd1392391f6a4886faae83bb2e533d5a28b41bc21c28dc3c7a669b44ba594f987d976e0fb544963129189d62b08f5e7865d0
-
SSDEEP
3072:Ovm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:Q1SyAJp6rjn1gOObn4b6h97
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe"C:\Users\Admin\AppData\Local\Temp\3e85eb8fc0c497b88234e25268f664fd74cd9ad82c6211f591fb930044a352ff.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a24cea687d953bf5b5d5f3cfb1f3b994
SHA1fa521ecc7bf89dc5ad7a968231bb70dfc74039d4
SHA256a51e869f6039a99166c4b895d563eb106f33b53b01080817ea932d705c5efe79
SHA5122e712d92989e20643c3348067026fd8b4d11e2ac373ca84a89328a4bb10748ae7c559a5d119faa639b1244fcd76fc7913c516d03680917b6e833bf6af664afab
-
Filesize
218KB
MD53fb78728241c57a9d6ca1f44fa6e601b
SHA19c4bf5e7ec4ff418a4eca06eb78a8c486a174cbe
SHA2563316ba1f732d4979f7299355b79bf80f97696311109f2b03a42b906b93df2ddc
SHA5121ba969f8e4098c2fc0af32838978c70a834cf206e6ac476c9e043416412c8f1f76243ea2041b627f2f7dc9f819e8db543f137564dc9f09fd819b73528a1d8d7a
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB