Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 05:42
General
-
Target
db242b1aa12fdda564bb964c0ec0fab154adc593976b54a1fd9177b9524eab29N.exe
-
Size
355KB
-
MD5
0353af4392e3fd11594ba5160b5481c0
-
SHA1
fa6045d22cca73a9f792214b0e23f45546eb99bc
-
SHA256
db242b1aa12fdda564bb964c0ec0fab154adc593976b54a1fd9177b9524eab29
-
SHA512
9d8aeca1e018fe6694505b9282dc2ba8a1b27de5e6ae257277b9cb2ae5f4db73228b3507e25c6f5762037d68eb69772f16ca8b90476085023a83c60dccb5c90c
-
SSDEEP
6144:A3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:bmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db242b1aa12fdda564bb964c0ec0fab154adc593976b54a1fd9177b9524eab29N.exe"C:\Users\Admin\AppData\Local\Temp\db242b1aa12fdda564bb964c0ec0fab154adc593976b54a1fd9177b9524eab29N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD506968906323c89dae515431bc0d569f4
SHA197d428eb0ed16e4f701fb3effada09bda2e9627d
SHA25670e36c4228184e121964781ab378df4d9ebb38ea8c7764eb890468b16241f6f5
SHA5126b7e9b385a3694fbb35cf8380073585c8aeaf0702989271bf8eef7f2cc5a0f430a8dd37e179b4af7a915fe6d85e9255435f125ac6e8ab30424e39f8b6d3d3f4b
-
Filesize
2KB
MD5fa0d00a3ad145c4b7b15b15dfb97eebc
SHA1e3521cd8c17aa72ae8c420be775510c9731e56cd
SHA25636829641451450b68c583d983d39cc44d6b35d794940dcb7b21e2498eac0e51c
SHA5124e9160b6f72223c8d2f79202b39e32e8adee8d0db065526bdef04b276ca01adde33b5156b8bab5564da5dc7b0784a48564b345e58ba8f13544a78b369b33ec32
-
Filesize
355KB
MD5fbd554a5e1a6a22c53554cab7e65dc28
SHA18e775e3031b62c7059fa59851cb9373ab2e7fea9
SHA2566dae3d235eff9a5014c229352b15cdc82780e09f794349e3ded3207e4aee41ce
SHA512ad1db0809f529f5e469652f0adbdb99794fe54289cd0e46f959dafb0e84f10e942a64733319496c40b297c71e62bc09b35f0633d7fb74a7d155d89ed9de77116
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB