Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 07:06
General
-
Target
fdd52f314e1553ba61065efd9d59cbeb9e0296025d7c025bd5c239848641456f.exe
-
Size
218KB
-
MD5
91cbe6b6423e14938ab596dd66e9b8e2
-
SHA1
c6b9779eeb19051a84fad97068a5abbadb860a6c
-
SHA256
fdd52f314e1553ba61065efd9d59cbeb9e0296025d7c025bd5c239848641456f
-
SHA512
5e145581f65dbf63a5e0fd977c296d98e856600caf3b053b759c0400f5ff4afc0c02b6c11cfbe3fda0bdd3541b88ddc7ddd93c636373b9e21a4728aa7379c623
-
SSDEEP
3072:Jvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:d1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdd52f314e1553ba61065efd9d59cbeb9e0296025d7c025bd5c239848641456f.exe"C:\Users\Admin\AppData\Local\Temp\fdd52f314e1553ba61065efd9d59cbeb9e0296025d7c025bd5c239848641456f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58981984d6466364222620494a99ac7a7
SHA1a2733d7ea865c16c2332d7768c6b2ffbd629dd9c
SHA256e4a6ac977a56b6b27d66b4317d9eb22f3cab4ddf618f1fc3fc409e084dfadc49
SHA5125be03cf5107cd9a15dcede498fe9c2c4f6260e739cbe9c66d7c7fa0c86284866bed25a805045308c2c75150e948e074712803d1ab806af27c9742415bbbf8f90
-
Filesize
218KB
MD55c8627c4f59e0abfb619e080c54ece0f
SHA16b5ca2a4f35a279f4bf7582893db67f1002a03fa
SHA256c1c59f4e4899f61df6387f0227c9349ef09762b6fdec3a9dc6eed134095e8091
SHA512935aea6e8a5fd46fbea0c885fd70e8c43d5a6f33344ddbf12758b6dbf157595d4ac0c3fabbaf2b9b22aff91cf54dbfd28b67d754825dbaff8f9c3b1d89d8a382
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB