Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-12-2024 04:15
General
-
Target
54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe
-
Size
218KB
-
MD5
59b7bee08b93fc653dd5ca7b97f5dcb6
-
SHA1
b19654c8d982fffc994bfc9ca69a958e20e0e577
-
SHA256
54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd
-
SHA512
5ffbf6bb29c6d4d532ec4ad7c854426023f45be703bb817119c5345a3bde0be2aca2d3c22ffc2ed0f273cb5f5731de76174020aeeb58e372660197df84ce96da
-
SSDEEP
6144:YEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICy:YEGDdQNHEwWlMxYG/wIz
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe"C:\Users\Admin\AppData\Local\Temp\54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD55d69b27232ef8b906846e3d66a160f85
SHA1c9ea5fec65bd11d6872bad6c61e36a964dc0ff08
SHA256bb8c4e97713ee7b55327ac04f65b91df2393524043ca48cb068cc6e2a8c626fc
SHA512c332fc50d43554d66bf6798393b648003ee4c62df00181c980a3838c7f733894b8b44f27b0b2ec36e97fad3ae3fad4c09cbabc2331700e1d792b7b4a130bea6b
-
Filesize
24KB
MD541084bf7971e9e522fe499add7f621c8
SHA17f8e73b2b0acac641e5db0dd9bac8d98348a472c
SHA256b1257482aab8893c4b4697f5053ccb17cf7dbda9c5f5b5089e8f1457cc9e6c14
SHA5123a3e75ffd8f1b3b87635b465362da80768389ce058e7968de7e5f274346d8740f92960c30247f9be960621716d5d1154b0038a761080a41fec4be6e1453813e2
-
Filesize
1KB
MD54a3dffac74845e2a424ef24587d76b3f
SHA168064d426df37de907b165ab623a19377bf1c060
SHA256d52e489e8110515c0e7c896928172df609ed4c9cb69d51a1cc9b5b6cea659314
SHA512e4adabae2877f5a8c78458745714713561f895fc2316d89f6405c16af3ee30194da14a97bcbc58d3e454691c471fcf0b81405da06fc07b4875b5673018fc6652
-
Filesize
218KB
MD503fdbaf28c3c8a94147ced77c1100a3c
SHA13c702de76698b99521aefe2ed4f194b072a5c52f
SHA2569330fa77568f42088196911525eb6d1bb2fba543bdcd2f59c0a2c71cf68223aa
SHA5120b8f51a13e844731526457d3e5131e2b41c5f332ee2af016fe85fcffd91ad5d9ca91abe47f5679171b64bcf5935e5efe08738e95448d4b9abf05f4f36b6cb068
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB