Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 14:48
General
-
Target
9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe
-
Size
204KB
-
MD5
b65afcbb9fc6101f8c5006033b7f61a2
-
SHA1
317915c927551b7c3fe120f55c42f8dd2797f8b6
-
SHA256
9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48
-
SHA512
0ea7a2f2dd9f3c24fd140c978c2c7edb25e2f91a14efaa420d83b3ab6cce0c817e873cfb8373b74321594739a237b33641e75855d82fd0f3d62f100d1f401fba
-
SSDEEP
3072:a5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:aLexkuRaX41xoyJV65gzyZko+ucD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe"C:\Users\Admin\AppData\Local\Temp\9e2430cf0d94e70c65625df4e9f6c5466597d213d60b0b10c6aa30151f1b7a48.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD5f12beed43eb9907d973e0e90c07b3f96
SHA1f0ba742267175382b1e65d71901458cce1aa971d
SHA2564e9f09cc77033cfdda4bc877f0e60564d89b47e8e2c8c3a9db1ef70158858073
SHA51277c4232f142c82c7b8df9b6e993ade8c3d86806c9b50a937281f1b738a34700b0744e79abeaeebcf760f3949405e811d44f6b569f419adc2a45a8d23c3bae5b4
-
Filesize
24KB
MD59b67b1ef738b84dde41452e24e18f3af
SHA135ec8f446035fbaea2638b7617a140f756e8acf5
SHA256192b771bbfb726c319e7b9043a7b767e9f9ea1976603648a8c9bf9e6460d38f1
SHA512c3ae85799caf4d4397552d732993486ad67bedabd26488ca0ef014a2f2d1723b4e5e77cee3c78b089a4e23cbb358100d68d3bb9d108e6d722fb6e617869f8074
-
Filesize
204KB
MD5709499abed3ce1bebb115f4db30f849d
SHA11274068217d6d0f316944761ac746ab8783df499
SHA2562ad535fe124692ba7a1c994973c8baa6eee8d880dfb33cf17bd8ff517d7dc99b
SHA512ea823d5df55282b28a63b522bb41f0e69c62d2d4c62d26b6638d34a1265842bb90c9b9c8ede79a43b17764bbbd8bd816a451f98b942438e29e4b0bc9d13306f5
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB