Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
30-12-2024 20:10
General
-
Target
1424f33226b43abee65fe093958ea983770f278e51993bf51daa53d0f982a641.exe
-
Size
232KB
-
MD5
89ce7d2c29444e80d4e9cf4ddb062104
-
SHA1
da5c7b7d0162a751fa99fb5b515fa96dce368da2
-
SHA256
1424f33226b43abee65fe093958ea983770f278e51993bf51daa53d0f982a641
-
SHA512
ac1d346c2dc47725ea41522e21830b364925cc4d17c9e657de80694899b261dbc10745bcb0451db7f590a70921a031462e0962e8ccdde23ef2562a3a9210c318
-
SSDEEP
6144:JzHnMLm5GNGxHUhtnkdpHqTKzhh8r6cb21u:Jf58GxUh5kHyKFhW6cb21u
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 18 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1424f33226b43abee65fe093958ea983770f278e51993bf51daa53d0f982a641.exe"C:\Users\Admin\AppData\Local\Temp\1424f33226b43abee65fe093958ea983770f278e51993bf51daa53d0f982a641.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD5d69178c306aff40b0ceeb32af5790307
SHA1c27366ab78efbd4d7b9b7db9cefb2658dde3a4a5
SHA256e9a32f562ec5a53c7130727ab8f7d00f76184f0885c0a14981a38594cc637cba
SHA512a86b576c5face3f0ee042a3f5d2312c9b18df04fcc193151846529875354d012e32d82ac363569fa4d129dd5bad86af5b56f753642b4edc2e4759269227236d0
-
Filesize
232KB
MD5c883e264124611a1b3cb4305125ca141
SHA1c82a8e403485ee471fe9c78972e23a29d598824c
SHA25645b017017b3739584aed07c2dfb9ee3555eff0cc4e02b38bd9243aecf0c34620
SHA512233d431679abc18553eee0d416fe00303958207b0ebd32667a28c1c2140d22cf98f90b5a72fc4259c74aa2347d100467d6b01e6a7ec48e0bc586f05b8e2f1fe5
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
552KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
552KB