Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
17/12/2024, 01:01
General
-
Target
d272223387c307d2f4cf75c97f680aa89d4a2dde77d712973211c53454638fa5.exe
-
Size
711KB
-
MD5
354cc04ecdcfc71f9626674a8c5dcb12
-
SHA1
a07857d7704512e48e6abd2d8ac28f0c6e45013c
-
SHA256
d272223387c307d2f4cf75c97f680aa89d4a2dde77d712973211c53454638fa5
-
SHA512
93cd93d5f0c74694e04e13082fb263479d397054cee6caef798332c5629b856bc72c0129b6dc25d0d081fce74a6ad46694656c41740a39cca1b68e7a8f6a1eff
-
SSDEEP
12288:YmWhND9yJz+b1FcMLmp2ATTSsdsmWhND9yJz+b1FcMLmp2ATTSsdS:YmUNJyJqb1FcMap2ATT5qmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d272223387c307d2f4cf75c97f680aa89d4a2dde77d712973211c53454638fa5.exe"C:\Users\Admin\AppData\Local\Temp\d272223387c307d2f4cf75c97f680aa89d4a2dde77d712973211c53454638fa5.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD551570a33c3464238950b5d15b2a67e0d
SHA1a6e9fab5cddb81af9ed82996bff413801ba10854
SHA256b09f812de0d404c09deed4dd45fe54702b13413dc1e15e7709975720045e2910
SHA51278cb2d4a2d06bd80a27ed50332d6e502f746401f65470ead0cb74b90e9b22d2ec0bcdda0f6ed7f70b70ebd005b12751915f7e5622afcf029680edab5473220d9
-
Filesize
42KB
MD501b4091e3f263cc9927e84eb8f27b438
SHA18a5f26fa8f8d5c4b1a5d8ee9809344956249b261
SHA256b56b563157c4e4ce38afd6defcf903465351e38e24aac53bc246b95d5d712073
SHA51217e6612575f0724664cb3590761aa4de5436ac3a1b189e19b3997fa768adab2d8e920871d820765accc636374e845193ffdc4e297ff806835e297f58f5157072
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
711KB
MD5a24dec523665556112d25b6b48132277
SHA153b435f12c506e3e97ae984db2ee955d02687687
SHA256d51176e300efca7d0eb350ff78ddd520e35ac75d11215d669b2281c82a220a0a
SHA512df6594992c7faee2a4943362b7f7dae9b6209a61a912929345e107a7830c43862452a8bc1f038e2b7446b464147b74744b9cf4f2727c6ed7aa0793d9289770bb
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB