Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/12/2024, 14:18
General
-
Target
16220040ee6f1dd5e69a0c8bbc21649caec349c6fcf8ee61df7d75ec55cbd72c.exe
-
Size
218KB
-
MD5
eb80e739055bbbfdf5dd5e01566a9b1b
-
SHA1
97b4a1e6fa94901519d693f42b01986dcfc2ce8e
-
SHA256
16220040ee6f1dd5e69a0c8bbc21649caec349c6fcf8ee61df7d75ec55cbd72c
-
SHA512
926f5f9b07c8c909e4c4b23144e320af4fd06c2f4810f52157ad9c7964490a4e616ef688ccd2e99e83142531dc6f8281f07b78081aa710d553adcdbb088e9f5b
-
SSDEEP
6144:LEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICW:LEGDdQNHEwWlMxYG/wIx
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16220040ee6f1dd5e69a0c8bbc21649caec349c6fcf8ee61df7d75ec55cbd72c.exe"C:\Users\Admin\AppData\Local\Temp\16220040ee6f1dd5e69a0c8bbc21649caec349c6fcf8ee61df7d75ec55cbd72c.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5b7645f3f47cb204bea9f25e77a1240ac
SHA1853fd002adf886eaaf8c1ccdb85a955cc9339751
SHA2568cea5b2eb23eed2dad34f26ae8a2fd042230dac4d342c7cca9cac0cdb39cf1b5
SHA512f09411480af0a89fae37e2f5a030e2135e237d208031166abf379959d07e5bd16cae13a3830ec7f54f4aa7dbbc8e8ab59f1982667089b5fbec08e220e85c18b4
-
Filesize
218KB
MD53afa71eb8c3e734460f85df7b96dc46e
SHA1fcaa5d594f60f3dda2a9ddb60883cf029acfccba
SHA256aee4671c9d04feb00822f59f231763cfb5e4ede227c0d560e65ef59e0b3c5b49
SHA512b2e5dc8973fd091057111494a6e593b53fb541e844e47b73fd80c5e4a2391af15bba0f9da2528d3649f2ee79e59382f471673ab6a3737358d5fe7e760bbc4b65
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
2.8MB