Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-12-2024 04:57
General
-
Target
fce770de731e4eb6cc2656fcc038019f55115bf42b9fd952840242719cc0adb1.exe
-
Size
218KB
-
MD5
505d616e108ffb70f7a35faff89c0b30
-
SHA1
956295297d84bb7a9de7e0c0511128f9116f0b62
-
SHA256
fce770de731e4eb6cc2656fcc038019f55115bf42b9fd952840242719cc0adb1
-
SHA512
817ff2c9b2ddb62f8f96171032434920951b18ebe46a20783c1ffed2ffdb4e11985d6adc43efec82f81a217ca00d58e0006211f90b4120c48067feeb1bb2eb10
-
SSDEEP
6144:GEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:GEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fce770de731e4eb6cc2656fcc038019f55115bf42b9fd952840242719cc0adb1.exe"C:\Users\Admin\AppData\Local\Temp\fce770de731e4eb6cc2656fcc038019f55115bf42b9fd952840242719cc0adb1.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD554f21620df008c46cf16958da4222569
SHA1a86eda4b399e21b99978ada837b4381258ad48a8
SHA256d30e18740ff0f20940129b8995fba8a118b187c2f56d83ddd0b3c5654898f7a8
SHA5121d6b900c635b97ee927387a07cdaff3abb3790527775f669e42bfceb9be9362823f61ee01d07fa181f73ecba2b285f157b4717ce4634f52b6ed45f4a86db1106
-
Filesize
41KB
MD5fc2012d2571fee1ed90cf7827a47e7c4
SHA1cdab86ea99a662916c207aa73405b3faaa4f1090
SHA25650c3cbabae945a0330f185cb2db715005b7bc72ad7f123c24e673d193474fc30
SHA512f3a6e64d66fc575fdcf900218e4179c836a747c0b373977a35b0e297de1f6f001b31b4e938c4888cf908e03cc0b42f06f3854afe9c56d33bc7a96d025da5d72e
-
Filesize
218KB
MD516f1e44cc13a7099e103d3cec52481c2
SHA121060520aeeedbca6050c4d005841b8d33082916
SHA2565727488ab8cf5df6bfb8b8113427c104dabfce932bae35f81a7dedc66fe15560
SHA512eeabb8a909a915ae7a25f908e506871e038a857c78ea2f3f9e971f00e148439d7bf872988c0437934ea5a84651b5fe5c20bfc6e2d48980227a5e5ed0627df4cc
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB