Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 11:13
General
-
Target
b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe
-
Size
218KB
-
MD5
aff18d8ea3b6d9a6c3de24f50d758d97
-
SHA1
679a93807137bced60955decede1cb3f99212a82
-
SHA256
b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b
-
SHA512
7cfff5537a3eeafb559bb6b5c4d9cc591ea8a9b2bd35b0212f17884e19b05c6515e1f14fe7dd894647513c4532ae352edaa64cdcbbc1c2cb2a6637657e4b69ea
-
SSDEEP
3072:Dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:71SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe"C:\Users\Admin\AppData\Local\Temp\b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD5fab4e2b75d48bc94b21981fcdadb01f4
SHA1a162d3a4386472e187bf515a59c29f529c769c76
SHA2567aea95ad1f0eec3bd656b5a3244006acbfbd04da714600158893eed3d52f9581
SHA512a08b10cca4f18a93857b095a663d3391627356d1e0b636ddb32f65eb1761bf5b520a7886f5634c5391c719958a5c0033dfebd11b76295bf22d4ff109e4500683
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5256f334fb2884e5a3118a2c76b0ac1ef
SHA1abe0e62005a054acb768476e8db7dc4a47c8b787
SHA2564839b7ae4fd2110cb2de01a3c2214a93ce2e73801db2b600355d30efcf1de707
SHA5122eb99f8a910214528f1ac5c1b0b4c4c0e7eba80fded9052053641aa2c18de6bb9698dec4f52cad98c74d7a825256f9e87d9caeedff4a169723fbd6c0de208307
-
Filesize
42KB
MD5617baf9675f5a0ecb5cf1da43b2f63e5
SHA15998d186ba6b12c0b5fde3556b201b48d5858f6f
SHA2560b23ecff553ae9c92aca658001b55b18b77a0e5da7a6f3febe8b28741317c64c
SHA512f8c8a51d688494317cc51b53c4239a4e7759ab9c09f97682516190b0d5f12962d041356c2d5537e06363336632d38c3bff3b03e5c36ec19d7dbe8fea57db183b
-
Filesize
218KB
MD501c5f54a10ee408943dc301097f25e5c
SHA18b37e217d9b261053503c4148e41653a64fc369f
SHA256b41246815169805ce4579ff06bc0462f77c1d421bc22e8e75ecd1e7ac1547d6e
SHA512e6e0bc6a88c455ff5d0e655dd54c20d7ff1f99d71841914d569fb91fff1343568beb2526d0d65f8b87180dead6f2d6477f6473240493f72b45132faac84427ec
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB