Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
10-12-2024 17:47
General
-
Target
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe
-
Size
204KB
-
MD5
4aaf45f1e44e8e680125294ad8315ba6
-
SHA1
c986ce523190e808e6b119d382f3372b34c86d8a
-
SHA256
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f
-
SHA512
42e9057c59ed90dcdb2d78a5729910c113cbe9fe79d63f4aab83bbc59446097ae4386c2606d084b549bb498c88ec2d7bbbaf9b71cb0f1a3873fb0cbb1825e1bd
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAg:mLexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e8a07e44253c020fa298660509eba1a0
SHA136989e38fa0055cda9b609cc2812c432f8feb725
SHA2560ec05776ecb8671b7baa10b075f952c5978986970b50517df1e92de31411dfb8
SHA512294abc8f58cef9aafccb5ee4eb6856a579e7ae0ea12c12d6c7f3464e94fbd00083598d784a4d5ee3db0a6d9e95af1e7efb757b336deed30d7590055aeede4a45
-
Filesize
1KB
MD51d0c51424571ec6b13932071fb378ea3
SHA1c609bc57681ba39e8f9b5cb95b6a35d27cb7f1b5
SHA2566d445c73b4627416be0d282f40d54869e8c1d30611afebec2754e1f581041d23
SHA5120bf3e7020ddcc1fd47f63dcdd9911f4564802f484234a044dc0e9e27de338ee16f9b033a6f1f930f10c5d72f240acead7b321bbebb9b793e9d11d0f606178b2d
-
Filesize
204KB
MD5444cd1dcd7d5c73d892119bed1002a69
SHA191aaf2a7516371099afcce311c93999b54993ffd
SHA25631ce23b5765ace53df4ada9208393b65bbe423ecbfb54ee59eeae8a9463070d9
SHA51284a5c2ba42ec8fa6474148170c207b7183bc7c202f115a97fbc0e4165fd6ebcdc21f960ef95ceca73876de6e60624484c22665f5d458b49181207cda81169978
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB