Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 05:43
General
-
Target
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe
-
Size
218KB
-
MD5
69698cd366448a9e31fd6a68fb9b5d6a
-
SHA1
7592e9b47ac50d1ae40676150d630bde0657a9b8
-
SHA256
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339
-
SHA512
cfbeb058340bf89755fb15e5e3a59b89394cd872c5f33cbe888b0dcc5b04b7d057cc7e81390d2decf1b10ce4651f9ea7a390136e23329e73109e0feddea010a6
-
SSDEEP
3072:Kvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:c1SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD503a8fb132fe9210c6e3083e67b284b38
SHA1fdf3fbb88415aa00f58f1801d53bfa94fcd66731
SHA25697157e6b594624ca3e69a21af13e2dbfcd713f7d1f6119f0e19fb0da8e9a804e
SHA51210545982043f6207213ef0b5dc723080e776e6feb297ef74d896fc4e2d21bcfc99e7135b5549f5509c1a9ddd097e522fae5284723918a1f015307d09f40b8773
-
Filesize
1KB
MD5981cfd169307dfaf60a07c8af1464783
SHA10bad54d80ebdc8f2fd2ff62982e1a8537cabc919
SHA256d65fd81e0d59580035571877ca0ebd1ffe3b970abeb923bc90fd6edf717b9098
SHA5129516ac32ec90a83e9058645e26d62d5235005d2a5a9e4cca47e2e787e813ae810879ec0e46864b67c9dcc5d1967f780a9671d0b27351c1cdf0f8edbb8efc6ae9
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5ff80f10b9f5f176fc22c149deb7b388f
SHA1bf9e019c9075a90221b914681164d8e81dff76dd
SHA25681c9ba9a52dc3a8fbf968734b9ca7fa559ad0a86b57c3c0318024bfa82d09b87
SHA512f4381531d7050b0ddb6600ffe50bb00850283ce4fc99aa8b3781d5f47267a4eeeebddeeab9dc7829cc15a903f936b305c528dab62f316934f5fe70199b8a1cda
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB