Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-12-2024 07:22
General
-
Target
fb274cf3db2949ec68912f29fc5fb6ba09cfe58f6a90fa34e6aa4af486261d75N.exe
-
Size
218KB
-
MD5
e4cc0cd2a508dabff4bf7cc99248dee0
-
SHA1
0defba2d0666fabf82470c94910c182543815ff0
-
SHA256
fb274cf3db2949ec68912f29fc5fb6ba09cfe58f6a90fa34e6aa4af486261d75
-
SHA512
f8d625758ae58c9c31a13fb7e0b0eec337f0de757f164dfb4ba6b4a2e7eca62c4d1182b3dc48b5a63f5a97330686da46508db1e3d808f5f675f5cbdddde29b5e
-
SSDEEP
3072:evm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:g1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb274cf3db2949ec68912f29fc5fb6ba09cfe58f6a90fa34e6aa4af486261d75N.exe"C:\Users\Admin\AppData\Local\Temp\fb274cf3db2949ec68912f29fc5fb6ba09cfe58f6a90fa34e6aa4af486261d75N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53262556d2cbd4267da2e29a1cf590f12
SHA1b9147cbcc45d0111bb00f659f945dad7cc323f1e
SHA25657fe3de6d2337d6a571e08c18b388c8ef9136957841226a466c1c9a04cf9a4fa
SHA512e04e61260052e84d4c7bf422d3304273c8995df6aca2709495d0e87283f67130cad929f1af4a391e179c951e26591852422ba038a940ab8739c02e39dc396d75
-
Filesize
42KB
MD5636b8c5c924e91b78033def0e36bfb59
SHA1cf363cde54d572f5f0d4a9f09d74f3af1156a88c
SHA256e8c04a5c3617b8f25a5629d1af8757c7c804fdc75b7d96cbaca0022656042c2a
SHA5128349c631e7c1ebba218798518863068f1c0bbe8adfef94f224bdcd064a55f7aa8dfe173c36103af97c998de3003d94a3a1dff09046f27bdb102cc3e0715ee116
-
Filesize
218KB
MD5a6e9ee90da493eb295c1829dbb87e2fb
SHA1698cb84ed8d267798cd32aece1d9dc0fb851d129
SHA256152651c9d75051732a53f7c1b46d30d7e6c1ea5174fcd958e4d7781aec7449d4
SHA51235eeb748ceb645d1cec75e2d28da8bdac97b886d81f3aead90f3e217b0d040e1ea22a20b081bdc90560d877f544b5e1aa7b4867677c503762ef20f64d3f7cec2
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB