Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 12:12
General
-
Target
fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe
-
Size
375KB
-
MD5
ebba842cec42bfbf785d647f750350e5
-
SHA1
8aeb6aa599a57f1bc44e82e89e8bc786e7d37350
-
SHA256
fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3
-
SHA512
a614b24215bef8cce662ec971462ecb5fcad02192cd5102f402660e2c5776d48eb3235cb45a15b1f0aa98272eda41feae04d2318043414203912e3da55f9fab0
-
SSDEEP
6144:F3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:qmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe"C:\Users\Admin\AppData\Local\Temp\fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD54a0f05f5ba3411d4a4dbcb45ecb060b1
SHA1c2463613081c355563a262b7528479c19e634e92
SHA25680ada97756c9babaf711df3b57f631f4bbf67a8dbb8cfaff9f0c07c67ece01b9
SHA51260f01602cbe689dfeec9c03e188f11ec0e174f65197e77c18bc6e60efda5b8f0244192c790a52079f5dbb5c4efc550b007ac2049aefc1a749a56b27930b5c708
-
Filesize
1KB
MD55a4c618ce0233f73526fddea4df9fe79
SHA1ec78fff7071f4293fd61ddbaed56e81536b80423
SHA25671a537f90d51284f77b38a5308b3ff269b34be90442993ced027a4e4fc72b1c9
SHA51205c22e208fca6885c49d433844c72f784aa101c41d5cf1c04429e679ba7996cdb1b055e36c58d2d2bc9db1e12a1fa83476f4e96d05f9bd96f95cc9a83aa4dc5a
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5b607d0e66adc3bb8ad2af711063adf00
SHA1040104eb7b91d1c70a32bb1a4cc876538de13972
SHA256f3962f87413a57a752e1dc7b21a1958cb07d8454423037a4ae55cd4b18353b9d
SHA512c300db5ef588fb241208cc7b3817c3fcaacfe44dd10f121cd5add54ef5203a389f3a13d91a3fd338bacda1888ed3c278133211a65c4ed1a32c28f76b16d3fee6
-
Filesize
375KB
MD5e2955e02675d2d24ca5a30339cb549fc
SHA1a86e266aabfc7475218998bc94ad0edfd8896aff
SHA2560805ae023e584f8325bc78059d6030ea8566d11f3a24abea1bb258f66738a55a
SHA512cad0f7ba4be54ec96d462dcdb2fdd721f30ea52a44e68e32a0c304adcfefbd73d2587bd7bd5e6ca3207ecc1ba93bc79fa585f6152a6f75d86a688f9f156da122
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB