Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 06:12
General
-
Target
e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe
-
Size
218KB
-
MD5
7c860e8e11de73b3f7d5e210917aa265
-
SHA1
1ea49811d417bdf65d90a0edca9bf100f80ea392
-
SHA256
e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0
-
SHA512
71f473757bd0cb5354f1cf377d62421a2000e572b0db68f993298d99c5b4b621f1137659492366864e9c222ae91f2e5f8e4d70b68cb756f700a668bbf647b7a1
-
SSDEEP
3072:+vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:A1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe"C:\Users\Admin\AppData\Local\Temp\e50f622457702888b9b014ba23677a1d2b70810e4f60b716a9f9cb536187aec0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD572987bec1bcf2b60a1f37499787e2084
SHA19306185dbec751a43b6702e1d7f6940ea3c43452
SHA256196d84ae0458253c511a5db86e76edc141f0ca01bf7e46f9b82e4b60e48f062a
SHA5128ed6aeb9052f3b3c100d3641f33a0b7beabf8ad587cf3a04313749b2555eb92d1b9b37be8a0b93c4ab021aaf0dff72074268d4883ca307ccce56b19ff95c9b8b
-
Filesize
1KB
MD56f98092a5c83b55cd862ec57012e07e1
SHA1e7b60398e0b0df99968c61db1f891ca4b2c4fe0b
SHA256af7223423062ddc1848c8260728ac419cef5a293017f5b49e5e2a88c1edfc945
SHA51257dde5f449f40391438877621f46c5084f50411754e76fbf3b37dd4873a733daf8138b65d422969ce57fe138683bbdfa3d10a48271cd88bb193ebd6088deed28
-
Filesize
42KB
MD58792ccf5bc9fb90ef4eb2723f22e1a28
SHA1adc93de4f26abda520d9ab18682f58bb3e4562c2
SHA256367553a7da630fdca453785bea51cbce6dc3519a6f6bb99de56d888ee33850ac
SHA512e9de94b8149dcd71ac752e64e9df6f7712d2293156dc680efff400b12d205ee414a88bf1a4576def955beea9f6412844ad78ca00746fbf7ab7a1d9f82c64024b
-
Filesize
218KB
MD52962e36ba623b76c1174a59748b0df92
SHA1cb8e912284e99e9bf90c3d41bf6e9ca452aa8a69
SHA256bfeea2b3f2e35251e9b617000e017e8f852c4ae040ffc72fab4875659569b5cf
SHA5125478ae522cf96d530aa8e9ed4d98ca8f177b24894520cb32c5e45c9fa20351994d0e478fd25b140f82b96f49c7ccda3b4352bc64fa8b2f4ccd0691e9ee35e5b7
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB