Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 06:04
General
-
Target
e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe
-
Size
218KB
-
MD5
7c860e8e11de73b3f7d5e210917aa265
-
SHA1
1ea49811d417bdf65d90a0edca9bf100f80ea392
-
SHA256
e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0
-
SHA512
71f473757bd0cb5354f1cf377d62421a2000e572b0db68f993298d99c5b4b621f1137659492366864e9c222ae91f2e5f8e4d70b68cb756f700a668bbf647b7a1
-
SSDEEP
3072:+vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:A1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe"C:\Users\Admin\AppData\Local\Temp\e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD53eb8ed541644fb7750125f745b801379
SHA1af07795d7f485d96396e0ff611e82acfa7adae44
SHA256395031d7f6a5189df21cf9c9d4ff18129e36b7d1d95320a7a4c630586f3c2a62
SHA5125a759a281d50800ad7864a14b450112e2cd9a06bc87681969a36e6f5aafe9edf8311b9fce76474288bbbf5bc8e2e37cc00b5df7eacf06b4031bb112af9db2133
-
Filesize
1KB
MD5c9b9f111ebe46dd8145c36d5154a1dc1
SHA1447bf0d8377c1a37f9a38771b7196630dcf5a4f7
SHA2563fa1ce3b002b2a44efdd05a93f6fb9b740fdd068f06b6dccc9034d5d91a57d10
SHA5120079640f19129ebc7d2d7ae6e742a8519f46613b6e8ccbe4ca23b2a53fbb89c86a3d61c3c0c4cf982092d7f1240212484daf1dfb46ba4652342d677409469cb3
-
Filesize
42KB
MD5349a42cc592bbb0b95e2c91eacb11195
SHA1b46f296ae4fe3edc25f7fa67ea4fd4ed96ac0d42
SHA2565cdf6835991e0ce11f3054cfbdb1b413a9ef6d78d64672d269ca5d421ef1ec51
SHA512fe580d8e6f69b11d514003edad0c911849015bac9f5cb0db06c6f815b17a1667a1ec48da5d4d07691685b387518cbdd2016430ad0010fa6dda39c11ae1c2b181
-
Filesize
42KB
MD59d6780dc16b2eb628a3907b692ac2caa
SHA1feeaad6118ab06024077ad3ae4271648f76c9c43
SHA256380b5fe8835d0da5d2ea8d3fd587510945c59922e912dfd13f6522b2791ef064
SHA5127d7c80bfc41940ac1e2cdeef6ec9bcd8e0686c06b36c38c5a88fbcfe5fcf63095f83f0680962b65d0020cbd626c84b05923573285825e00a9cce03cdf0f08767
-
Filesize
1KB
MD5af5acbff998b57e5efd2aa4dbeb48d0a
SHA1f113a1503bac8cafcea39b99f3a5b970d3c81a43
SHA25621e58ccebab76859c794ff5929df3e32a50b8abb0e8fcc830ed38f4e1570eac3
SHA5123fc0bd0efb791f99f80531c6c7c56e51129612bd64a98905e39ee27877bb1a3766a7c8f7d746e07a80a1d60eee44dfaf34e792aeccd1c451105f67b739cb8145
-
Filesize
218KB
MD5ce26661c9c7ff66f46d9524cbdaf4af3
SHA12a4d81686544cc08fc365ff9e7270269c724f4cf
SHA256f42a35e824cad61dcdc0ddebc68691d54e1ce44cd4c8de1cb861bf296f687371
SHA512f7ca7a0ed3fcf4a53f8985b2aa15fc8c40e42a5d9acfdf95948adf9854bbcf2a7e047d1682abafd3e521ccd7224c4bdeb1c10d9b293c6b9ad0c881fc3c156842
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB