Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/12/2024, 20:21
General
-
Target
ddb191d52c3ec0332079a5ed769c022d07b8129e56e4e21ca4dd5b599778ae93.exe
-
Size
375KB
-
MD5
8c6edccb421f7e54a3cca940f2e1aa91
-
SHA1
93de9b24c0e92b494334de6c68f42fc63bf57496
-
SHA256
ddb191d52c3ec0332079a5ed769c022d07b8129e56e4e21ca4dd5b599778ae93
-
SHA512
b8e6ad41f2b5e2253634c60158a1419452b06db57006a969fe0045724738c7481faa2ef327135240c5baf793d1f3862c01f006d411f349ccad8fb622266ffbaa
-
SSDEEP
6144:s3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:nmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb191d52c3ec0332079a5ed769c022d07b8129e56e4e21ca4dd5b599778ae93.exe"C:\Users\Admin\AppData\Local\Temp\ddb191d52c3ec0332079a5ed769c022d07b8129e56e4e21ca4dd5b599778ae93.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
1KB
MD55b2ce5c4ff0c802a290ec02a9edf17fa
SHA156331e751dbf36f576dac63a40ab5244b481dbcf
SHA2562f7c772e169c551ab776ac3d0acead85e71b55d148b468f1a363f7f1cbf64dca
SHA512e867be3f6ea6882a7baeb401e760f745fd330939cf13fb9e2a4d08cb1c821a83efc710c3f10aa8c9c78282e4a231acabea4c17e4dff08f00fc235e3e4be6d590
-
Filesize
375KB
MD54b8613925bdd14587e4713e42112c4d8
SHA1a4c0ca8ea5160f369721ddba9877604b8639db59
SHA25645b987228ce3ebc1ecd734aefbb2132fa0b1f5a40f3a68095352077793f6059c
SHA5122e73326800145d3b8e6798f3a65832f8356cd736d3aa127a6d25b28aa91ac77751b0686e3b24d7d390be3b5f3b6d9f445f91ec3377c834c9d0a63851704c9038
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB