Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-12-2024 01:37
General
-
Target
50dbc6192179e984d356319d353415941c4d2d4ed7f1b3c64848a739e8e1a776.exe
-
Size
217KB
-
MD5
3583d86cabdbc125b4605800322f0922
-
SHA1
7f4dfba958a651f858603ae4a4aa17477292e1ed
-
SHA256
50dbc6192179e984d356319d353415941c4d2d4ed7f1b3c64848a739e8e1a776
-
SHA512
ef9419655872268ee0040c43089ab6b4589969b63417e69fc46cfc8603448bc3837a3171be0536e44647e43576af49cdf6e8dfc65b98b7f73dcb8417f93b6322
-
SSDEEP
6144:NrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:9sTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50dbc6192179e984d356319d353415941c4d2d4ed7f1b3c64848a739e8e1a776.exe"C:\Users\Admin\AppData\Local\Temp\50dbc6192179e984d356319d353415941c4d2d4ed7f1b3c64848a739e8e1a776.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD518154d8b56c1eecf527c413b6ec6cf67
SHA117b5d3af7c011ffea37b8704b9edd5e3de93814b
SHA256cc6de35829d31bea9a405073d07956fb3549214f3c4df384cb7ae7d961b54084
SHA5129450413cc5295e2376884f076ceffb148fe79443dc7024210293d78e0e9251b421577f394e9b95ed6dd1126c194cb3770b28890d7cd6ad5525661e55d1335a32
-
Filesize
42KB
MD51b740b542cf56c68ebdbe6ea5efd7900
SHA120ad71e359dbd4dff50734fb92ec24df969b9cf8
SHA2563600bda4ed0b3fc9851f0caeb57e8e85cb59c00866e560fa3a0aa5b64e92990b
SHA5128392919474b416c7d2cb9ff3cf8f2e1c7413040b1083e0f2764922bdf1f97fc62a34e79644296cf15b568e5c594873db46b3412362d2bb36e81ef387bd07dba8
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
217KB
MD5fdc2a3a938010fba8eee8ca025633218
SHA1dc4498a953f6ca90ff362fd9087378d829e3606e
SHA2569ae9954a58c897816d701230739fe8a3a7f50bcb233968f4ec206eae51330192
SHA5129b0231e8af05565cf2aa1448b10a9845b6a70b23810f656c7421004bf4e17497f6cf40f69c448b0bebf6eaf0e7b0e9893468bdf552feaefa302134d288252803
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB