Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 05:54
General
-
Target
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe
-
Size
218KB
-
MD5
69698cd366448a9e31fd6a68fb9b5d6a
-
SHA1
7592e9b47ac50d1ae40676150d630bde0657a9b8
-
SHA256
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339
-
SHA512
cfbeb058340bf89755fb15e5e3a59b89394cd872c5f33cbe888b0dcc5b04b7d057cc7e81390d2decf1b10ce4651f9ea7a390136e23329e73109e0feddea010a6
-
SSDEEP
3072:Kvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:c1SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50a6a33e3f219d373fbcedf949c3c1b6b
SHA1f3520bcf10cdf40faa4485dda124f9025481f606
SHA256907fbe471b250cc6cd9d7fb2e635259f8b1aacd61e4f1febd571f7cf8c9dbcab
SHA5124ef6314f4e2d9253ee4f20b309c757c28a4517e083b2af905fe4d87ee59373a2cf79186f1b1b3f22ce28dca1d4bb63ad65b86d218023e61a4a31dd6f640872ce
-
Filesize
42KB
MD5c32c3c599a07067178692f59bf7bfe4a
SHA190fccf9418fe85f9601d3b66325e363634fbf750
SHA2565cadef02e1f985229030cf79b5252bd66b94b79487d2f50a771ee450c817549d
SHA5122c76585911a0f576fb722ea158d8ab205098d03e0327234a7834362f8a5a8d77848a25cdd11c62b9d801947a729323b204d9ce80cd78e84a82104e310adf07de
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
1KB
MD5e459cfdfd34f3405dc29c9b1b647f142
SHA1ef9c2a96c89122c8b7b35612ab75ed9d2391d7d8
SHA2560265b7edd683a0b8b4b7eb70a4aae6587781dca974cd37e7a8b5ae24d4ae2d3c
SHA512b2a802e33ed6970589b926ed39020dea15a892270f5b20e0e86b6699252670fc2f76d7aea30f85021c6e72d401f298b47a53d58b66d906d33c82e7dc256ee7c1
-
Filesize
218KB
MD5bfd2ce8437e2f0dc2ff1a8925458a568
SHA1aa52f72dbf2a791c0442f33d5187f1b0561632b6
SHA256c279b9eb10a2a4827a8ae45c2606e3f0730e3026f035a753babe701e3fb54184
SHA51216e9e05fa41b890cb3a8656f25caff34e4f1c90f5966050ad44a96d3156b730ffd9a4f3015453a06f2a27871e54af15b310b3873272707af092a602d9e91c8bb
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB