Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20-12-2024 04:06
General
-
Target
c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe
-
Size
355KB
-
MD5
e08f5e14795b342c881a797f79eb5030
-
SHA1
c16f989b87698352671cae8a8521b583c257d340
-
SHA256
c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6f
-
SHA512
56b5ed968e86489ea25b392b2b114bd7f05eaa9fd9ecaaa5b1760cda5e86cc1e44e6531c58b471540ea8a23e82d274ec9b7c73f632471f403f2426d4fd7c55a9
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:3mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe"C:\Users\Admin\AppData\Local\Temp\c7e6e55e382c4011b56fa52db3dc076215e3d880bf7c52fa5a6f26a21f069e6fN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5631da2275b777cf4f094b23ff3f71056
SHA13050ce383515d7b50a10476972848ab61e7b57d1
SHA256af4e0c27b83b43b689ead5470a86e2eb7f93d40db0629884cd42aace4eaa869f
SHA51217bdbda10e669a121fcb8219d213a300b6c6e30c9f5c58ec443be558825ae9668dfa36dafe1a02875c7cffb86984bd57120d2ff1b6ec57536f6dfa42072a3ba3
-
Filesize
355KB
MD5f1a851962e070995be12dfb24b4bbf44
SHA1603439ae195f92970cdaffaf040f214308f07bf6
SHA2568acee28ec68e5fe26df4706cad0fc5f0897152029db1544fb0e77a59cd655667
SHA51217994cba7d5eda960d8c85096ef63b37bfab0afdc97676d7a6ce96cc14692658ab3fe564b0ade069f1e7ca8f058d1e1946a28236e688be400823c921464f0575
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB