Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 18:30
General
-
Target
804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe
-
Size
217KB
-
MD5
e8eb976d380ef0a12570951c17328508
-
SHA1
41b9971c0835dfd1a9d5b9c00c2a4982686febab
-
SHA256
804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270
-
SHA512
fa24ad999414713222636da5399af404916af454c0e5830b54479027353b7090a058c849b4b3c71eb20a01b3ce2cdbd474094e67f75593f5ad06e0eef9e85d45
-
SSDEEP
6144:mrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:UsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe"C:\Users\Admin\AppData\Local\Temp\804867362e67c3f5c0161c50925242c74fdfc5563303407e71425e000cd97270.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5d7e56baabe7c5221ee77d9055cb2cd73
SHA1f5ea7a74be30bcf9794118661bb38a9e0e334c0c
SHA256898f0516016cdf1b610a9c72cf1928f75f0e06d703c6c9539f7550039b143e2b
SHA512504cec13a6e9666e4f6577392dd5264c5fb4d4953a393de72a818bfcda305bda8015cc595ffbc7439ec3b86cb7c54138269962f8935b53c5510a40f60c71a8a4
-
Filesize
42KB
MD59fdca6669136c9b750c83576f1bd8797
SHA129061f2f64e8d92796060bdd7f9e4732b17aeaa7
SHA2563c51c122559973d442b192342b8f274dbc717198bcf1a184dba6982bc78c851f
SHA512f0f5ab65874e7ee47396649ea1fa744a1b488a0e4a7f12034bfc3c53c394f66468b98c7d7c03c80f550691bd6d4531c9f2c358ff21d1f80ae85ddb6603b817ba
-
Filesize
217KB
MD588957049ba40cd5ffc7c747d9a9241a6
SHA1e271aff84e9dc8965d1be6c1ee74a8e0211b7702
SHA2560c51f7130cbd0678fac4a59e972bc9e40cdaeda28a07af120c72712beefc2523
SHA5122f22effd6719019437684d30c0c9af16ebd467be7750821ae47a4f30de8c3b017a9f69f3063f695eec8984e95f218e693c857f462a0adb658838ff0d6d6fb4bf
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB