Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-12-2024 21:54
General
-
Target
9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe
-
Size
218KB
-
MD5
64a301ea296a161ae103f5014257a668
-
SHA1
ee18d0e4347ff337e188925e2f2e41c0fdab437b
-
SHA256
9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890
-
SHA512
718ea249a55483d049d3788a97b1ba49e59d28ba66cc8e75ca617985be1af4c9b0bc186f160a66a22a82519480586d20fce7eec95cf1d051a9bebdf4b52c1381
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:R1SyAJp6rjn1gOObn4b6h9r
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe"C:\Users\Admin\AppData\Local\Temp\9f5a2270f9a9813011714b042f822edbf0de50d0dfc9117636b76ab100e4b890.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD584da1c0d6288f76e499143b54b1cf565
SHA177fd16e5e7753573bccb62392efc6c630b8d8369
SHA2568fa94c81007647db11043e25a58f76ef2e9d6d0ed435e124d6477b710dfdf9d1
SHA512c8eb9b16b67f114a2668a7c14690db2d6a062c4676484bb145c31939f58cd8687f202447edcca27f355b1bb903b0d4c1997830ceca2e41a7651a34ecab779e88
-
Filesize
1KB
MD5818e7eab3ad1741cf1f85e42d4129478
SHA1da4ba163d813d80b6ee9f08433bb4c77e9a7d8aa
SHA256b188cd4cde1e86cf168f4179800534f356ae81d2edbf2dade603de57340d71d6
SHA51218fef363dbe2e7775d536360fa93d70db1bd42f8131c524dbce1e08953b6aca50108553318b68e9a386c43d29b7462b9511b29f5f808da3388dd47becbc6b802
-
Filesize
42KB
MD5b5dd28c7216dc912e3b46d40dcb771f7
SHA176e4764dff0d1b058c499652780b27e9de0aac2d
SHA256e479d58b5a228351fefdd031058c9acd474fc89c28fbebf076cd30bf5a62fdad
SHA512ce253936e390c3734c40e3402f31364e57aaf0939080f1a0abcab463051681affbf89584a772872cf61aba93643e6f7eea2a6e912d97c2256831199cdecc8198
-
Filesize
218KB
MD5bb55ad7ade6ff39db37a30cb05e4f89d
SHA1754acedba187a56065f90a9fcd2bf0bb5baf2016
SHA256bdfecdb5dca00418ed953811720c551d7fecd97f86924bddcc8796877e298136
SHA512c7683ed342393bd2ed7a898978a0c2c8d75411a5eff0ec49dcf038db44082806c52abe1407830e07b37eb7b616060d3b38a7043e5b58bb9c69526716a4466f07
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB