Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-12-2024 22:55
General
-
Target
62ac5ce5fd88ea6e94440451b0449bc0dd25ea7c9c6df83eddbc403ac393f934.exe
-
Size
355KB
-
MD5
eee702e9c13b3edbd45f5bdaa07f050e
-
SHA1
d3234d7b726de8c45102a35ca4555dcee5cdcca1
-
SHA256
62ac5ce5fd88ea6e94440451b0449bc0dd25ea7c9c6df83eddbc403ac393f934
-
SHA512
ac97927f23739bfc4ae598a447f997feca3753daf12c07a4c5812fc5cbe668e5e6f25f48ff8dd5e115889f8016da9b46053c6542811d5d5de3a1ded77e780c3c
-
SSDEEP
6144:93EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eim:SmWhND9yJz+b1FcMLmp2ATTSsdm
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62ac5ce5fd88ea6e94440451b0449bc0dd25ea7c9c6df83eddbc403ac393f934.exe"C:\Users\Admin\AppData\Local\Temp\62ac5ce5fd88ea6e94440451b0449bc0dd25ea7c9c6df83eddbc403ac393f934.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5e36f71766f6550e9d81fb6b4c33108
SHA119f9a04118e763ad260079a5ea46bc0f4326e508
SHA25654add63437be9d895da229b7b29295a34136a89a3ef4c0c67217843321a6e121
SHA512a5448a2640e22a8e141aafd3bd6cfc9d8713cd326db6746df6ccec99f776c69ab89abbb812b3d0d9731735a00c49ef229186522390257340386dfc4d60d6d6e8
-
Filesize
2KB
MD5e7d5144636ffb636fac16acf751a754e
SHA1f992d2e5520d793e1226c8cdf3b4a55d52fff1ae
SHA2563c5d039153fb9ebaaaa43078b533c22c635ea87b7c20f11161738d6f79e3af33
SHA512b3d137337d3e0626e5c45c08a82bdf46ea3ee533dd911c04c7dd2e5a9c2c6b547ad0690d523aeb8eabec432b957da3e7c04088a682ed7460ee6633a7cfe2365d
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
355KB
MD5cdbb8e9a58e7519e2eaac77968a3c4d9
SHA1b813e002db461a7ba04c9035eb9d2bcc991dbdee
SHA25611e512e22438806847c41ed126ec85c2758c6dbde648a3cfcd7d75f7574e23a0
SHA512622fafb9df4c262a03479ae8950dd13ba96c021e59d11813e7cfcc6d7181159dbcb1012b2829e0747b103125dd9521ad1a9e573a7d6ae0afdfedbe6e89d7edc2
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB