Analysis
-
max time kernel
116s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 22:17
General
-
Target
8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe
-
Size
218KB
-
MD5
dbac50ae11f74f56baeaf940200c0810
-
SHA1
c302cdba3ab448121b9d1bd7746a843a70efad14
-
SHA256
8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630c
-
SHA512
2280aaed0c7b6d3998f853aa486eb8f4a5a44b29982ad318138aecfc840fc3c1486bcd029ae486d26f62f8b0ffd65bd3b6814c58f3f0bdeb71de64369d15f940
-
SSDEEP
3072:Avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:u1SyAJp6rjn1gOObn4b6h9b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe"C:\Users\Admin\AppData\Local\Temp\8f74e147495d3003534c3f97753e074639a9d9d82ae0dccf48eaea74fd91630cN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54b020891295cf997a95333713718e5a2
SHA1968e5d91ab939f8f60fffc1f6517234a6d2de4f1
SHA256702c759e536587c210deff23b24bf11921b1ff56e7f569d49f29dfed2b90eb62
SHA512453b375f92807fd9905aac1309ef990408ee4469585837b844988b1a6dac63d22ae935790969e2f50ef1e3e0581f9d8184b35ae8716b14b318763f0bae3f8a85
-
Filesize
1KB
MD50d5059c6e7eb354150fde8d3dd4c50ef
SHA1659d1fa597074cae75e03ee86a8c4abd9903d009
SHA256372875960e27983352139317624ed0c09f3d2eb79cdf478677451369a5eb0865
SHA5125752d317f24c85f439a49c87ec9633a9cd893f1b45c706fd9500e2337b7ed60b53dd21748a77526a392c53c4f0555b2f320259ca04683b88f783d47353cad169
-
Filesize
218KB
MD5ae74ed69374d93755287e18cf6132130
SHA1ac3556fab47dd362dc00eb3f712f53b770024369
SHA25683e61994efbe323e808bcb3821a1e3d8f1abc92a30d6c1765bb333129cc7c3e6
SHA512737ead1c51da7da7e450ffeda4a4ac15a26fe5e6a1fd5de63c75708a8dae5f6dfda8a31bb3118754437892a0602f7b05143ac89952357a7d93527b2e7c3c47d9
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB