Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-12-2024 09:43
General
-
Target
fdb1b47d3f73104c5d791a7f8cb79c173e048fea569cdfa0efeae73cb0a33a3b.exe
-
Size
208KB
-
MD5
2bc2b5ab3d83a5fda7afc48e24c91db7
-
SHA1
92bc15258519e97a0b87431bc85d8a88ca2d8d1d
-
SHA256
fdb1b47d3f73104c5d791a7f8cb79c173e048fea569cdfa0efeae73cb0a33a3b
-
SHA512
8ca4873f2d3aa0dfb2f37b5792e7851138c5ad594416de0e7140b34f33efa6e4835da5fce101d23d45e414c8f4058d04f9d51c5693bd08b6f2a938ef185526ef
-
SSDEEP
6144:Qa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:QbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdb1b47d3f73104c5d791a7f8cb79c173e048fea569cdfa0efeae73cb0a33a3b.exe"C:\Users\Admin\AppData\Local\Temp\fdb1b47d3f73104c5d791a7f8cb79c173e048fea569cdfa0efeae73cb0a33a3b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5e8e5ac186b657bcbb69d27bdfd28986a
SHA1f715b98a81602cc1dc5e0c9ae036542900f2e5b4
SHA256f3e77a80eb32edc8f05d8514c51fd60c119253eb92477be6d0f5510b18e7b35e
SHA512a8484019a314e14b4c5a93534570271d9e9d1f4ec0b7059a578ecb3ffbd9db129f088978b66ba59f3dd07b2c0ae4659c30278110830275420837f718456e5271
-
Filesize
24KB
MD5039fce9e2722221154769f7ccfb1aecd
SHA1079df6602fbf4e49eba3523d89e73f86bf9f7ae0
SHA2569af8ca89b0ca1f3db68f5d1171e669042835c5a25cc0eb64043e0c9b742db0c4
SHA512389c5213de0b27406e73548363ac8e2d20c17e229070b642f46a038202464ed4865f853a7471f2b49224051a491305dc6bc0be0aa093f106fce8da0641692ade
-
Filesize
100KB
MD55aec8c031a99949ae139572b6c58855a
SHA13432a8bc0ffa557d75e179609feeef269b81086a
SHA2567600f971770d19afc41b629828b7a0652373b47b4ed76c91b7314112d3ba1a7b
SHA512275a70f484e85a9ef401fc3eabf8ad530c4c1fc7e739ae29a2799d28f43014b0261f20f889ffc1f6899b627bb9d0379a85215754ccf8d2cc758d221b78197dad
-
Filesize
1KB
MD56a68171eca266f725b7b1d8231900f33
SHA18dcb9a823a33b440a2d6002f02c057a9653bc4c2
SHA2561d1abfa28ea6da62f07393f2fd447a64bd51baa545d946d14fe5b546eea3e8c8
SHA512148c75282bfb4db7d32e4533e92cfec787e9963c1a546f48fd18622bb20ac9f23aa2235726233a9319a181b8bc2ef22ca8b91faa97c64cdab2011285a0f65e8f
-
Filesize
208KB
MD52a58bca026bee449ebd0a406bf917110
SHA144188ee4f4be247d23636782e6941d04849d2727
SHA2562004f2aaa41ad6d4236604e28a1e4a6abe61c196ab2bca62af262d36db89def8
SHA51220a293823cf772c8dc1c11e96235ed973618cebc9dcd337ce58534539d37511ab7d27e63c36505c897443c60629f0166dfeea6d573e932be85f7736deafc0b57
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB