Analysis
-
max time kernel
116s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17/12/2024, 20:48
General
-
Target
38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe
-
Size
1.0MB
-
MD5
4d3191371f74198e82bb5bfe0bddd7f0
-
SHA1
9b632cb16b07e88724085239c44dadc249b11d10
-
SHA256
38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424
-
SHA512
abe73d7fc6bab746d85c0b4ba3c08cd2beef927b5b7f309cc85051ff84072755a7d9c731c6aad3e4f7dc9218c0c2285c0dcb5ca8b9ef74332c9fc7a8ec72be33
-
SSDEEP
24576:PmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:PmV2ApemV2ApemV2Ap8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe"C:\Users\Admin\AppData\Local\Temp\38e1ca030d9bd3babcbe6dc927e4ce69231700a22788b94ea0e42c87f0ffe424N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5060de2a9582a7e5ccae874ed94b26d66
SHA1a0c324136796539cf1d7d9181b5484f8e82c2069
SHA256c9c3602a8a77959f2d5921c8091e1cdcb8b49b692001f250dcdce438e02f0631
SHA512ea6071f100b47b915a3537494e102774c6005d35914568a3c011fcf94bdf90c3beb29349a58b52986bbebd0f603088a58072bb050399f811368b1d124da43741
-
Filesize
1KB
MD5ea07bc905d09dbbfe89d7d358ef0c4e9
SHA1b94bf1e9ba0131af189703a3491cd458f0ce3308
SHA256ebf71caa9116576610b336df73627c2228d2306182072cf96250efa51394c48c
SHA51238d82f52b821a897a4403ecfd124f15d22b9d19940943a6e8e9b12b715a48acffaf934aa3d06707dcb77fa6e872963db7491ab41c1a052f099bf01edab2dfc1a
-
Filesize
1.0MB
MD5bd7d91750175c46b99a72d504c784833
SHA170741fb6deffcd7273147091d99d64cdecf9c45f
SHA2564ca49a62a41329668e87d0f0327bc05b7da924575dc1b49aaecba20243736f7e
SHA512fd90dd80800880c670411199c03a896ea84759d0e143c666892ce795fe5209f987c5272e1e5c4e59ab49d7bd54bc97a8d4fe5bc61df0c253688ffacb5eb91271
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB