Analysis
-
max time kernel
115s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-12-2024 01:39
General
-
Target
91baed087948f4c2e543a8ded75ae3a9647cdbac7d08f790f959586a1302febfN.exe
-
Size
208KB
-
MD5
46ca2078e016deca6fde711f6c1b9b90
-
SHA1
3695ad848d1636bd1ded0873047d918f1d9d5e4f
-
SHA256
91baed087948f4c2e543a8ded75ae3a9647cdbac7d08f790f959586a1302febf
-
SHA512
d56f15a87b51bed9e1a63153935e643f4f0ff6c019d847668be41dffd416f8883d4da02f7c1d33730dd66f86348766271214afe58edf5889c527a512aa98c1cb
-
SSDEEP
6144:za1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:zbapK0JCmRcU9vVokfj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91baed087948f4c2e543a8ded75ae3a9647cdbac7d08f790f959586a1302febfN.exe"C:\Users\Admin\AppData\Local\Temp\91baed087948f4c2e543a8ded75ae3a9647cdbac7d08f790f959586a1302febfN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD576c383587cb762650eeba128ae355abe
SHA1442950eedf161cab26cf196fd4f9b787a13b94dd
SHA25642f926b1f552500c034ebd0354097f8130df93a7ddc861b7ff80fee40096fa7f
SHA5124ac922869cdaee99f0b3b5f565106cfb3a540607289ea80c6ebdd33744264d9ad3d3416ca238b0945da8040d4be28969b7991c0c8dcd27b3bc5a6bab470bd81d
-
Filesize
24KB
MD545ed330f3bf7e71a3150ad0b9a34da15
SHA16254bd1ccb25a87bbe9cc479b6f2d34fc6d2e59f
SHA2566b8a2d587957371996bb4cda1d6044534af0236d28e6f0443fb6ae9ba799b9d5
SHA512dbf6c787b152ff5bd20885178f76d2d10882c9442b5e9414ce8537aaf22427659021c3d1bf861a29e2e8571e14a30d4568dd8a85bd3d9fc1b6ffdfec4195ee3a
-
Filesize
1KB
MD505fefa7229bfb878756a23cbe8174c5d
SHA13a182c8268a26c4ab4e75c6a9b009d87f1b241ed
SHA256fbdd210f5719ea80441547635b93dba0c662f306b27eb950cdbbdc6ee146bfe8
SHA5120dc904b68ca61be292d3cd7f479e60084db93e84ce763b75246c7dcb330858c6d760fc3b43f08e569e5393f092a61aa2699e1ddbb9a173c70950106f6686fe45
-
Filesize
208KB
MD5a2586d12b34b560334648c3a6b264cc9
SHA17bd5497f4bf664a3969149b609d945503a427c31
SHA256afd4b362f7a0870c27fac16051b33a00a0798206e8639f2c01af53d8d72ab4b9
SHA5121886c4036a691461e35b79a9ab53e94be203082aaad19f3432426186d6e866fc21c0023ae2af62c965695aca7b8c68381f4a396d4a1ae4062aae5fb7953bcb12
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB