Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-12-2024 21:13
General
-
Target
2f743046f4ec2464ffb37aada1480a5057f5512e79e1f2bd93349ef5c7efe410.exe
-
Size
1.7MB
-
MD5
4257f51ce00e476ca75e7973996128cd
-
SHA1
d6dd39786adbb5221a0e3683d368438f76f3bb97
-
SHA256
2f743046f4ec2464ffb37aada1480a5057f5512e79e1f2bd93349ef5c7efe410
-
SHA512
cc97e8870a1c9a0a2da72beaf3f8c0a80cbcea358748074725cd6988046ff64de412b89b7fbf63c44647ec30af23247376ea447239b5f30407987a748690f630
-
SSDEEP
24576:DmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:DmV2AprmV6mV2AprmV6mV2AprmVG
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f743046f4ec2464ffb37aada1480a5057f5512e79e1f2bd93349ef5c7efe410.exe"C:\Users\Admin\AppData\Local\Temp\2f743046f4ec2464ffb37aada1480a5057f5512e79e1f2bd93349ef5c7efe410.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
1KB
MD5d180d91db5522842c60036d9ba070e57
SHA142a859529f8ff05ebb5613693d47863609ff141a
SHA2564b077e8eafd652aeafc0ba1210b5dc2977f717be0aeb09be497344d1728b7010
SHA51213ad5d92c15db1892347ba3838095960656a8968770e2a5a50bbe9ae346d21455fcab573a39fede33a84fd7fb3b427a59ba3d6d85cad4b362d0fce1a52213122
-
Filesize
24KB
MD5c7e7fc1e6e08627e1872a003feea8d78
SHA1585c5c2dc07c66780815442ea8c5ac98bd1b68a4
SHA256c52062d142216b348ed3cfe60e63be44ef1ef78b25861caaff2080b975032c5d
SHA512ab5df7b35fa6a8d290367dc76379d874c37ba28c5cc0130cb34022506188a5eaf6b06071819a761af8efdfcf9625031e10e3694cec371e9f586021f7d9c585e2
-
Filesize
1.7MB
MD5455f0f09a7fb60698c8d271df2f34250
SHA1a1ce6f7aa15b54121c8f78a2b32887c1f919e6bd
SHA2562a4bbb329e97f7bb3f3e157b3e1c3cfe636072e3048f22ed67b74d2b49fcebab
SHA512fff21ab52f9df3e67c963e5b83cb899b672bb212db91ef6fd351ec2eb33501dae559e4a7ae901269d3e0c86a3a65df89af0dc95f0188f0e117e73e9538d6e6a6
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB