Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-12-2024 00:33
General
-
Target
24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe
-
Size
212KB
-
MD5
add558a89362338ff76799d266864620
-
SHA1
1e6599db81b57e4ae4e099689989af3cfc72888d
-
SHA256
24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90
-
SHA512
3f2f7dd8a1f9405549f86a5a3cc31ac055da751a12e917c523b3d7c09fbfe8628d250a1ee67d72112e9f8fa3912c7d4ced1c36648e330e9da0ec66e68c31e504
-
SSDEEP
3072:SGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:SG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe"C:\Users\Admin\AppData\Local\Temp\24969993f8835ba7da7ad68853f2ccbdcc22a9fd801df50b20c921ba297b7f90N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
1KB
MD5a55e52360bc424bb97c24cf5ffa81baa
SHA1ec3e7537a2712167cc263e226eb05d8ceec72537
SHA2563209bf2f94b7a1b601cf748e315523e013e2174d0ef9ede571b8423ef8a7dcfe
SHA51212d85943ec078445852b6d8afe712adc785810d8922f9eb16a586f4c525c7f5fec109a1516e872295f81b96cd39c6187ab2e6dbd0854b7f3c4048e02bd40a1bb
-
Filesize
212KB
MD5747da4399baa41e874a6ffafaa874262
SHA1748ac74c35979b887c283c76cdf798e7ddb5f6b9
SHA2561d1ea73e8fb5cf6f84fc37326b1eb2512ce767cbfe21d7ace90f21cb47ddb1a1
SHA51294b0308dc82fed0180dd40c4e40fe610d26a86cbcd4a3ac20bba23ff471ac807f759c2d94efe7185bbe9e23c5c72ed91df63e40301387a50f9d78f8639b29f77
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB