Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 21:43
General
-
Target
60e020a290f5847017e0d109543adda297c7003b556f1b3b71cce9ee35ba8e14.exe
-
Size
355KB
-
MD5
004ba2f0021c3ba6ea999c95f0709a14
-
SHA1
f58ddf25ac66f0652cce091ffae7c35ee20bfe1c
-
SHA256
60e020a290f5847017e0d109543adda297c7003b556f1b3b71cce9ee35ba8e14
-
SHA512
dc4afac370db8ec1587cfbcb529f0698519db569e64f0a5ca7399427eaad149ff401ff14c901748b5b1d6ce64111810f4779f53000e3f3db9e0356d4215cf18c
-
SSDEEP
6144:UgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiP:2mWhND9yJz+b1FcMLmp2ATTSsdP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60e020a290f5847017e0d109543adda297c7003b556f1b3b71cce9ee35ba8e14.exe"C:\Users\Admin\AppData\Local\Temp\60e020a290f5847017e0d109543adda297c7003b556f1b3b71cce9ee35ba8e14.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54a26ddd1ddf506aba01a7077941bae65
SHA166011162e2bf8804fe388f4dda5809bec3624a89
SHA2561fbfa96631af7d3557002fe4c0d1521ff2693533e40e1cc955d9a2c6550d09c0
SHA5124d68b590bfa550c83bb949ad42379b3588991772983a1e1024f5ef5ad51e115995c39eb87cc35e2bd097d48e116ab3b2a214deacae9ffe597305bb73bcaf2c5b
-
Filesize
42KB
MD5eb0270cfb0099d2df58d43d9f36c7b92
SHA17dc47e7c0795a94d0b96f84d45d4658b5d055863
SHA25608069ba77740c50263be3f796be721d0f38be858bdcbea82abc29bd8ac59dd72
SHA512adfeaea8cb7508bd9efc57a2e54df81b0a1a4ed4e7f0da38e977531150f1f207f04129860f6107ec3de291a3c10f8ccf308a1823d77d929c6d9f2d389a73164c
-
Filesize
355KB
MD5c0b3695778fab3e3dd76eced7896dc30
SHA16ad81c007130d776bd1ad21eee73562e6c4f66b0
SHA256f9034abab157e54226ae8f2efd14d29ccabb04b836689beacef27336c88d62f8
SHA5126b138645ffa460004440a2b0eb9b094c2f2ce30d532b4888b7108ca31f99e7835541a1f4b2cc5f5ab69fbce8986822202c6a6bbd0133832a3e770b69e93fd760
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB