Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 08:27
General
-
Target
a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe
-
Size
218KB
-
MD5
6c89f7fbfacd88c622d604d64901356d
-
SHA1
ccbe262a7ebf42d7a23f1a446804b156a9ad3caa
-
SHA256
a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28
-
SHA512
28775515352fedad535db982efa23413677518da7b07e0e8cb6b6f55fa36406e626364bdff8bf897e2b2b00b69953f9be5686b7de18ea2d95e1fe77bb254c6bb
-
SSDEEP
3072:Fvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:J1SyAJp6rjn1gOObn4b6h9J
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe"C:\Users\Admin\AppData\Local\Temp\a99ccce46872f988d2b9fe5fefd3501a297bbe612e45f27ba114364e26177d28.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5dac27b25b05884e6ea21da936b4da98c
SHA1cea2dbc5a0bd400ec8d1433e4e63290a02bdf5d5
SHA256536fcf9aaaf4c74f6d6a4437c3b6a2999cb63376b893871564308c6b780a2e10
SHA51255d1f423d4c6de0eac282f823762cd00b1cfc4378ed19298f1264a7559796266da9b3f7130c9035a112a32ebf6c8651b642bdd53ad32a9c30d9912b988622aeb
-
Filesize
42KB
MD500a2b7a59187dbd97365d8f98eefb9ae
SHA1921050f0020e55096aed67d0c4cb5c9bbe520199
SHA2565251ea9deea2d48557f8617e5a1437180fc0bc4298b2bba27c159873599ffb29
SHA51225a0f1fcc9b7690ba6d330df9f6eb0b342563ff42972a4104f220a11df72de06c4079b896104044dccb5b97efd2e84c31d3e95b819814af2046a4d9e9499c9d5
-
Filesize
1KB
MD5d0360731e328e6b1896e936bd8af669a
SHA1046734fcf069a2a09e8bd4f55ff11e4f07f70288
SHA256fc87b88736d3b1e3104f7015149d958994dfea85ca42ec33d203d2878c104ce1
SHA5128f8e1e71b16674729a4e9b69c7a20be292231982801c4d8a7f3cd1fa3f68da8c15c00404d11d677deb5e9f0e31e7b93b6d98a754ea42745d4e6704223f66749e
-
Filesize
218KB
MD5aae6a83fa786b03f0d6f2cf1d5d3e47d
SHA12992f15b9f1015e8b243d1cfd34af18b08a27b10
SHA256ddf44690b45aef7e785218d52c7477f657dcee0f2f7e980ae7173fdfc2fe98f6
SHA512706520e5bc92c457a20de5c907c69acc54a46826b75e9d83f963ddfc9a2059b5c640a5f9d477c797e0772fc1cdcb2a03963fc685aa41f694be57c14097499850
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB