Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-12-2024 04:25
General
-
Target
e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe
-
Size
204KB
-
MD5
c422a66130a60539ed8e053e4dd98364
-
SHA1
32cf7b42268a59d19fff89bb44bc1dbe5c4191b7
-
SHA256
e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49
-
SHA512
8eb4b47382299f8eef1a8c3b0d69eda2518b7b23a27d695dc4238ea496c4f5c0a2e8d6ed649e2b01b014c1e756bf73268e8ca77b0615e110cc951818a864e41b
-
SSDEEP
3072:95u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:9LexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe"C:\Users\Admin\AppData\Local\Temp\e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58cf0cf1d5f2e68c1156af2a1ea36db03
SHA1da0340467641f9b05abc369cd29f0d78339a618e
SHA256b10f4e1781d3de56a721a6f15d0b9cf4a1b1e8cebead57e81ec27371891f2ba7
SHA51224dcb9026208b96d14ce2ca9f457df1af90aed0e319fd5da25dac08ffd1481f203df749594d879f6585a8bea84150f01c74757e641666e9631ebe23cd2a73c30
-
Filesize
42KB
MD5025f23e3c92552fc8cc6ed37f0f507eb
SHA1f06c52557a373e274573fadc9c339fc95155c5d4
SHA2560e2afdd8f6a3895342fccfaf6e8c8310454fda98bb2c3bf465e6483e13ff6f6c
SHA5129dacdd70913a068a6552743508f6ada6631c94ed3e6079f5a18a76bde3591b2dd1a07bff1ca1e1bd74828b2cb4e1bc2e646e1b4a19cef2091f85ba16bc1eebc6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
204KB
MD529363ad0f0fb7ee05cdd6ec2428b6ad4
SHA1916e03b18962ccb30ef4bc544b8d5ced98b5c5ca
SHA256aade7f9df235d1466637b2cb0bc0196175d8679d69231aa3582ed10867ace728
SHA5125660cc9ba51ecfe9f73326d3f0eed51d707ab868cc9b88c8b7d1af11fd7a23acd1ff8f568ed4c6f4c074306abb9af3590f59764f6f9907be3e378c5699722724
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB