Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-12-2024 20:05
General
-
Target
b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe
-
Size
201KB
-
MD5
a3d687fa9689a7fd5c70160c13fa3d0d
-
SHA1
ef3cc5d3ae239590755fafe3d7a8e59f3bc8a71b
-
SHA256
b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4
-
SHA512
fc4d0c5171b5cba9c60c65c61612bef50b976b1c3e940d4ef4af226f52188350f77b544a8a9d624b08e33244edba18bb017195ad25e025d1ac3963ccd1885f6d
-
SSDEEP
6144:gt++Jbojf5Vq5OC4qZhZcKYhc/ZfUozYM:j+cff22qZhZcKYhc/3
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 18 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe"C:\Users\Admin\AppData\Local\Temp\b88ed10ae95066643a0669b07afa0af3f8dde206e48af16b7fd4035ee8a0d7c4.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5601ff2cfbf1c3d32aa77cc0327dae147
SHA1e023ad4cfec94706ae5d6d0b02ee1c1b08d86b37
SHA25698fe52d41172ac55785a5ddd43ffb41fb594bb50b3cc8edb6a86275f7dd841d5
SHA5128af79b797c11dd9c47d7314fb55abd31c345ae142f360fea815cd99e4e14a7d72b1ecdda8c690f3fb946d784f30e71c8828d979dfd830d7ebfc2608270ab5678
-
Filesize
201KB
MD5c2c6b1ce72b1cdbe242ba0797e5144b2
SHA1de88785a1fa0decbdba159c40f0e4614f3e9edd8
SHA2561a47b6405ec939931f2163673cb98936ff2255feadd43fba1d52548751f4e9f7
SHA51284bf2c1842f489eec0730a8c11e84f704970eae7d94670bb41a888e9df8d9471576f57e4244cdd9353b0180eb420a84a2d9f7789ccdb8e6f229f3b11ccc20569
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
580KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
580KB