Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26-12-2024 00:31
General
-
Target
95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe
-
Size
375KB
-
MD5
06fd84ce6df33c2ac493f8d7052082b0
-
SHA1
06612fb6e51084db8fb0c8cb2e658248951cf977
-
SHA256
95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332
-
SHA512
faf0f666f89f6c4abf30dc6e0387b49eb35efcd7f1016f76dfa510b0d32bf9d0ff67fddb03a5d186027dfe7419f9785c6ee874ebf3c5ddfa43cb8ff11223fb78
-
SSDEEP
6144:n3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:0mWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe"C:\Users\Admin\AppData\Local\Temp\95cba0302f44a33d39ca7c47c903f3ab78457078482a5d934dc895b9b2a3d332N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD51785826831ce254fd349a1793fb24c68
SHA18f4c59218f09a5c356cfb9c51c1caee5f86c6156
SHA25634f31704a2ccfe075395958f6f480c16f6e7d34086f6c1ddfa1a5b46f2815906
SHA51259aede8f79097de011ffeb7e1b2cbd653c78b1b4ce3c008ef752ece1bfed23e1413ce4623f247a605c2bdd9a4f7ecdcffab72b77261158d8402e3b57a947eedb
-
Filesize
375KB
MD5b972c46525d58e84d4ad72b23a46b1ee
SHA1e082817b0b1abfae47101802cb689006b7a0dbcf
SHA256a1cb1c2e9ea69cbe743cb55b463c5a0d9319b3fddc9e997558f4876c90c7eba8
SHA5122a303ef89d10108392fc3d6914555830f9090967741621d237301dc829c25d5b4fb478df5bcf78d11bdea92c4a2f8825054314e44a2988d832a5a08e1e7a1a47
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB