Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-12-2024 04:14
General
-
Target
e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe
-
Size
204KB
-
MD5
c422a66130a60539ed8e053e4dd98364
-
SHA1
32cf7b42268a59d19fff89bb44bc1dbe5c4191b7
-
SHA256
e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49
-
SHA512
8eb4b47382299f8eef1a8c3b0d69eda2518b7b23a27d695dc4238ea496c4f5c0a2e8d6ed649e2b01b014c1e756bf73268e8ca77b0615e110cc951818a864e41b
-
SSDEEP
3072:95u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:9LexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe"C:\Users\Admin\AppData\Local\Temp\e97915b0d67fb6af558b9b943cff34df1e5bb8e281725757dd398d25dd51cd49.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5e7693d426169f433beee44c410890b74
SHA11374c22e2cc0c7b95b226993408d0340e7469fbc
SHA2563e4f0f30fce00633204ff3df15d7a8a56b3f96ce236ef594a964c0600f13ac12
SHA51243a54d5fed2a16a20828fcfc40df1f557794ef16bcac91985910557d2ec858ab10053f9aa572eff3687b117b79f52cd431946ff4a652d4596eaf56c158cb3303
-
Filesize
204KB
MD54ae5e4fb2f9bb680fe5e8040aae6d73b
SHA1faaf1cc132082a19c34a4b03c992f40f88b294f9
SHA2565f3bbe19dca6d85411612ba67f74fd943d7024dd6b183fc9fe5b6a7c4a09f3e1
SHA512a15eda6ba8157f63baab6a5b9bbb3eb559b757f7ebdd0e0a217ec4fb3ef71b0d4edcf1d618009f5641fe0759a3545bd82c7cd2e69a41442a7cfcfb8f0be81980
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB