Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20/12/2024, 07:19
General
-
Target
f98af86ac84a39b03c18a46704578069f99735800d5124ba36f180733eddde76N.exe
-
Size
208KB
-
MD5
9a8f0a4cd072a4376a023d1047a5ca60
-
SHA1
2c1fda6c5546de45a882bf72bee6be01960456be
-
SHA256
f98af86ac84a39b03c18a46704578069f99735800d5124ba36f180733eddde76
-
SHA512
42cf0844732456f88a493957b6d376593425fd0949ed826dceccffbf6826d2c6c73ef0ae842bd4d11b7425a7f68e6db6165156e1cbf397afa6404b3eb44f1c51
-
SSDEEP
6144:ja1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:jbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f98af86ac84a39b03c18a46704578069f99735800d5124ba36f180733eddde76N.exe"C:\Users\Admin\AppData\Local\Temp\f98af86ac84a39b03c18a46704578069f99735800d5124ba36f180733eddde76N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD548f84b86c9e11819db62d30625a315eb
SHA13fc61d825d43ea67e5efa813e0a5ff1ec724bcb6
SHA256d1a9f1626da7a3d8783c19a3fce80121768e2fd2e0e4bf6b77fcb0150ab868ce
SHA5123c0a3acd82f80b7f44d9fd25d004be3c0963999cc053989077676d12ef62047b2a499bf076e2da7e82a31233bd7a74d334a0bba0d197ba5fcb122ad3574a95a7
-
Filesize
24KB
MD5484608f916f9f4b197e19d92443c22b7
SHA1ba1408307b952f614ec7baf1a4c0c7c1adb3ae2f
SHA256e28bf8e5ccd0b115c32e0a5ef6a3dde063d28a0fe69180e1cfc95b8362a8c2cf
SHA51275e29980fb9a163c208f5b99d862a19cc5b91727b6016c7bb5e23efc62a23e5306c4ea57991dd97c56ff28df53c5a5c971345960ea3c756a77013636ecbbfed2
-
Filesize
42KB
MD5a8cbad2b8eda5f767a347ef053f1b97e
SHA1038e7d6fff1c2e3bfac1bda75fbd9982c8cbc946
SHA2569c6693c3ca8b44d9ce6e222623e60d4cede5a132cd30d158f515728e15362769
SHA512e56fae15bcc19bf0cf828233565322830b47506a6bfe37c39078047469489a709194d28482dec07f811b2425860cbd1820c668d24cf9a6a1f8de8dc8c4590ecc
-
Filesize
208KB
MD579ce8efd0bbec67a4d62047362c20eba
SHA13116aaa1b853a31003b048b839cb32023005a580
SHA256c8690980485c0970de4c933d7ca7dc303698f478f25ea99c57e4cbbca99af9b2
SHA51296a679046c1973fb3ea090b171eacd029c994d5aea7c8593d95931855e255a511e79151a85a09034f5ebc3b68955e5c6449e4ffcd72de71b4b5690ff3116d156
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB