Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-12-2024 22:03
General
-
Target
4c94ae85b2352332576b3c2da571edf6d7fbc15f206499e1fe222517a26c49f0.exe
-
Size
375KB
-
MD5
f241fc72fce499124266da54b6889228
-
SHA1
742c713d004d38f261ac00daf3521319ae822d0f
-
SHA256
4c94ae85b2352332576b3c2da571edf6d7fbc15f206499e1fe222517a26c49f0
-
SHA512
47406dab116929ab68f2d3b55db799b06425fd81459d555ab53c04899b4c7fb2263ccbff2913e2a0bbf721d5325c3690a0a4072bd48abd3e9f1e75e00597a12c
-
SSDEEP
6144:X3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:kmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c94ae85b2352332576b3c2da571edf6d7fbc15f206499e1fe222517a26c49f0.exe"C:\Users\Admin\AppData\Local\Temp\4c94ae85b2352332576b3c2da571edf6d7fbc15f206499e1fe222517a26c49f0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD518d82846a944da6ad7266b4041ab91b3
SHA13d51f77e548da3e9ea33cdb60099756b1c0f5323
SHA2566c127b0477f7ab117e1b7315b296b1b8d54f2a6b464997aeb75b0fa4d9596091
SHA512b04fc509b17eb4e76199ebfd293f5d7efdd44a8190fc5ddba37ce450540488721a4969046af6e93118e95e7501054a28f235873fefb14ba823af39072915cfb7
-
Filesize
24KB
MD556285020d88a2d4bdee937b2abf2660b
SHA167c32207a7cae9257db565fd4112c29bbd0eb957
SHA2568ee496357ec2fa448300623adaade46891bbc4951882fe5aed21483a6f73650a
SHA512f0b761683018987cc94f6277c93103fbc0fbc89d314c583a80a9a5591987b40411b81edcfe08502e67b893cf000e5ecf26574a6b62037c542ecc449d640496d7
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD583c420b2eba5e2e8f97aba1eaedc611f
SHA183f8b10487076511200641d154f011941d8fe6c1
SHA25629a2db86b354a1147a6e8cafc8a5e636bcd3f8c808106d1ba7084264cd1f27f6
SHA512ec53d7645e1c82b73db7064d7813550fa3b7e5faff6994ac2b167900a6577bdc843844e6ab5ec49cb7298c80005c10886eb5e0ebe0ff31117b4d912496993d61
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB