Analysis
-
max time kernel
112s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 11:23
General
-
Target
19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe
-
Size
212KB
-
MD5
7861f6588717f047b11e3afbdc7ab80e
-
SHA1
d4a6dcbbbdb52b9688deeb9b2fea69a6dedde2d8
-
SHA256
19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3
-
SHA512
06f9727536332e2b308b4eabed04bc161a203093bbdba1f49a180739c91233c4427ff424e69e681bf49f58150d4bc92c3c73db6ce561b22b696740b9d4a91c79
-
SSDEEP
3072:SGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:SG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe"C:\Users\Admin\AppData\Local\Temp\19ba9bbd06014f0319826468c397d520bc88cb2d21f5966a60179ee2fa9297b3.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5554bedbc31207e8b5ee139e510dd721d
SHA191cac392e835a52730bfd5085979cb13cd18bdb3
SHA2565465bc991b9cf371e17d2711ab7601600c8541114d77dc9615454d42ff0d3ae3
SHA5122eefbf92ac149215a7eee8d4960544c239f93f1e245d6074f777b6633fe30d3255d7e4371f855011cf13c3aed05ed560251d6dfb87664409ef193111db46ab2e
-
Filesize
212KB
MD502d653fefdaf9bfc8bdc9745865a32ae
SHA131bf2ca106bc3bb86d4e4715175e69542bd0ba36
SHA2563f93c3b0c6f6125205c31bfaaa1f9120d8559702d01763f731f4b8ff1901fffa
SHA512d9ce36c0ae0ffe4d00af24d774446be8536a27e7925692a8958a583cc6c761e7393ad42dcd9c52a72db13cea5b9826cacc36cf17bcb6b4682ad6d4a92289194e
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB