Analysis
-
max time kernel
116s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-12-2024 06:55
General
-
Target
f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe
-
Size
218KB
-
MD5
95aa08e0f5561be45587f324808d9bc7
-
SHA1
9c475f3d360ae3ab03b64cea965fd46e6abb7ade
-
SHA256
f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b
-
SHA512
eafa57288f216e9a00b603ee6f7d9ec059c2f55332daceffc60db548858e9b6accba9a8784ccf6c6422b11ca48c8eb26f26e6dcee2b2daceeedea21625d4502e
-
SSDEEP
3072:avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:s1SyAJp6rjn1gOObn4b6h9p
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe"C:\Users\Admin\AppData\Local\Temp\f53edfa55a5e5ad71588d8a906cd546014f94e3f37fbac06a4abe949f39df31b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5ead9bea8cf2c35d29bf6e5ebeb4ab9e1
SHA15819d78c3cc4329608f4007c3be3787cedae3326
SHA25692c087ead5bce90b99d0122ea8e7ef7afb0b48b506558a9d55698db37b96a844
SHA512435628e38c96db8639b35922e8256f57477199b67b1bc328aea0280a3a317cf0dd2f49859445df923a95677aeb436b9d9f849ce6ca0254fc7f5c60f9034e8412
-
Filesize
42KB
MD56f4b1cedc99af5635eec32e48f5b0ec2
SHA1475290b6de93c316987d2caad316f1ace65c5b4e
SHA25685262afce239b435fc6e8c1c8584f7e480d7280d041fd26e1fb588e773816116
SHA512beead3da0077bc52cf2dd05f63010d55720425453d12a6ec9d66ad62d8f0ccb3356e8aaa79a04623d997c17de6cd411faac771301a13d63ce00b06df4eb7163f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5eef0b887672d91f79bb51996342add12
SHA16d6bccdccddad5ba0eb99c42cc78f104b67aa138
SHA256f1f0b29a2b545feb730ee5d0279f63f32cec687df88995955463277e23b75343
SHA51266e3e880771e1a6ebd96735073d2859d9c7cac28f4ab74017bed3101752d4f01c84831ee8f938f9842dfab5a0b25f40e7b122ca6a4119ee04d8119cb345c0adb
-
Filesize
218KB
MD51184c6173f7c94f2a03b59c472a2b4ea
SHA1cea8625662ff1124c085e891dc80db9777ab0ce0
SHA256c7b24b19a2ed2d49f1995055c3cb75d3a2a6f869076eab9b9c0f2dbac0df4b2e
SHA51248cbde1e559b52efe22cc39d35f74b23679f1a2ceb83dac389fa96a901057083e8ede647674b21fdc3870ce4bc9b998b42823dbddc34fdf8ae37ad62fc3f7b43
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB