Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
19-12-2024 23:38
General
-
Target
ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe
-
Size
208KB
-
MD5
6720155306c26b338515957d1171ac20
-
SHA1
e37fbc46c416d62443c162773628a1be8d554440
-
SHA256
ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8
-
SHA512
95c127ccc737dd6b7fb76b8e52007d60637cf0e2ed7cacb15ce772d47517bca793dc35621a81a1f62481447abf3f3a7fa2480391277971b9c4ab2a09fc8a1aed
-
SSDEEP
6144:Ga1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:GbapK0JCmRcU9vVokfj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe"C:\Users\Admin\AppData\Local\Temp\ab5861e2101bfcb72a6ef89a60a5b1f67da3fa49de61fd8c1038c0bda3eb92b8N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5df808391ba5b94f457d7c9366e8d320d
SHA13dc90f346f7517e3902985c2179a82a30a81e550
SHA2563c00415907bbb2ab1c979617274621c706fadbfc18af14e2d6207d9893f674b6
SHA51292529a9fab2d7b5c38547b354bf6acb4f1d7e7d687d0208260d87ccd97e80483c3be88ebc86b91d127b6cf23155e11e1692b9d23e48e93e08f67f1ee627be5b7
-
Filesize
24KB
MD56b5dff751ce6127a09a2fd99b4c3e713
SHA154de744a75d001a3c526f9a7892d9bf35aa3cb3f
SHA256a8115c508d4c094bec35c82ca9fed7e3d07b50b2710cc7855b5113f2e480be01
SHA512d12ff69c4d8576188ca2bb40eb607a35c3d779963039c257c0263a390e9c9ec3c92c8ffbe69ad08affeb3996cee6e7966c247ace8edae66dffc0504d98735a4f
-
Filesize
208KB
MD5225d3eb548c4a9e9cf5ca9e2a62dfb3f
SHA1f47497906b1fc93d2d93478e83cf5725c172d414
SHA2561c9ce85ad81496098b26304211600e46fd32292a2d6987121c387b60439c12fa
SHA512c3da38dc2d85fd7ae8f82d0367524ee0749c3c74ccbc8389f6d9afd69c7706bcd2af5323607aacf6a5a9fcfc192d18767d288a5d1c68b85f1aa5992cdcbea5c0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB