Analysis
-
max time kernel
112s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
25-12-2024 18:26
General
-
Target
804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe
-
Size
217KB
-
MD5
e8eb976d380ef0a12570951c17328508
-
SHA1
41b9971c0835dfd1a9d5b9c00c2a4982686febab
-
SHA256
804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270
-
SHA512
fa24ad999414713222636da5399af404916af454c0e5830b54479027353b7090a058c849b4b3c71eb20a01b3ce2cdbd474094e67f75593f5ad06e0eef9e85d45
-
SSDEEP
6144:mrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:UsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe"C:\Users\Admin\AppData\Local\Temp\804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f7aeaf6c0163ea18682a36aca9dbf9be
SHA198db260dd854de47ab8284cedf57454dc83d4988
SHA256b41e5ecae76897600fbf7faa6e33a7ac036cb6ce794ff38cb96fd18cf20e480a
SHA512929fb795f91f93f5f85cb59f5f2b3250a513fcc1035b988b401e09fd812a629e3f83c266c30fa99a9f8f579ddbadc2efec3f9d96b35f4bf55fed93ab4cb5879c
-
Filesize
217KB
MD57c866d0c464ea9d72c16918144d48007
SHA1fae1ca3cf631d50f90199a8cdfc67417aa1a3beb
SHA256851616409cf0b3bf1e379b8ec5af6c72f403b94a2820ae233bff6a52e68fda92
SHA512eadbecce7228e0e0d0f6a7d2e6b82e8dda63be22b6d1aae30da197a506388fcb9081fc26d407f67f046001c802263c61533cc8cca9154caeb92f3a4f3c3e09e1
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB