Analysis
-
max time kernel
107s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/12/2024, 21:15
General
-
Target
67ec54f28083b825045238e39f964094cbafcccb953a8cd07ad0dd07481c85b2.exe
-
Size
355KB
-
MD5
1f3900e11e0746bcd6b91743efe31ff6
-
SHA1
fa7362630cca757a711729f08a499167b8757b3b
-
SHA256
67ec54f28083b825045238e39f964094cbafcccb953a8cd07ad0dd07481c85b2
-
SHA512
1da843b7cbfa095dbf781392c16ee21b060a928f6a14f49314d90025ea55ba5439339a826ed9142f8b49ea4c3b5ad12d6704a178f827fec70653697f932a0886
-
SSDEEP
6144:A3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiC:bmWhND9yJz+b1FcMLmp2ATTSsdC
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67ec54f28083b825045238e39f964094cbafcccb953a8cd07ad0dd07481c85b2.exe"C:\Users\Admin\AppData\Local\Temp\67ec54f28083b825045238e39f964094cbafcccb953a8cd07ad0dd07481c85b2.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5321ddad60b4e88238a53b84836790035
SHA19a56d8fde1eb4b0d77afc53574f895c430105caa
SHA256db46453795299387c6c889fc1eaccfe8311f728576dfac990197b432a338a6be
SHA5121dd7e1b08db915a41f6fa3416c79f3406e9016c26519e7ad4371a8cc9147cee2e319552f70081593a9d9e8230b379607984132325d45f27fca3fcd4af6e0a2b9
-
Filesize
2KB
MD55b2ef418acb899e540761937ffb16a0e
SHA19016b26be2de291b215af9318d55d90a85d65a98
SHA256065eaa2d4d15fe92fea2a2013be3779bfb8d7a0772cd80baf3f247109fac028b
SHA512e438fdb58a611cecd6d8343056b333b15f0bcce80ef1aa3c11e20ecd69d9c4cd1764f0c961c06570a0bafab96191b94b171e618e9d5afe24a5b23a0722ce30c2
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
355KB
MD56839b9fdc6bdb811e9c5d1ce05dc4637
SHA19fde4b55766b8f30502204794d6daaf7bd68bba6
SHA256eb86b8620e28fd04eb43f3e75bc71886cafca1232ce5d5cf2c857282be29bca9
SHA512bb34828f23756299675afb4601222367e199c0305b6fe9ae386a5f08bb2a9db340c3fca0514840c84929d44b0e74dd2ceb3a445d11f5c2c4e02db080d770128c
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB