Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 17:37
General
-
Target
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe
-
Size
204KB
-
MD5
4aaf45f1e44e8e680125294ad8315ba6
-
SHA1
c986ce523190e808e6b119d382f3372b34c86d8a
-
SHA256
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f
-
SHA512
42e9057c59ed90dcdb2d78a5729910c113cbe9fe79d63f4aab83bbc59446097ae4386c2606d084b549bb498c88ec2d7bbbaf9b71cb0f1a3873fb0cbb1825e1bd
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAg:mLexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52b46c792aae5b26a709a7a1faaf95c39
SHA101f9a76be2c6e87c1b7ce019efee1011a7ccf9d9
SHA256d26bb27608e130dfa4bd20f543f1a9441d0066b97823314b7f62219e3bf84c10
SHA512432d12a6e114b28347519e1993573909bda3607fd88cf2f8dc3b4a5dd0c8cd1842d374d4fbb1b4374227e0b3f0acd611681339b44faff23ece0e3ecbb340b9d6
-
Filesize
204KB
MD5586ace1ca86fd0cfdd5f5d954fd11a17
SHA1ac706fd4be75efed8a2532f855243a4a42fdd4f9
SHA256b8284445b035147a197a3e4c528061f6d1a28a931302c3d9c711da36720d15d0
SHA512654a7a0d8b802f06fc4d3a07545dbabf2ed9c48ab93add39551d85282066b802288d6a58e607d5df914f382b04a959e96ef0c5510b18e221a0666dcb1e6c4970
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB