Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-12-2024 11:17
General
-
Target
b230419f2cc3f4a871bf6f0ae32da722d1bc54c474ddd06c2671e0b1c99457d5.exe
-
Size
218KB
-
MD5
4320bb41c03b93f3cca96e6db4d165cd
-
SHA1
bc938d4f4bd0963fc3dd15736fbe1c2c62e3467b
-
SHA256
b230419f2cc3f4a871bf6f0ae32da722d1bc54c474ddd06c2671e0b1c99457d5
-
SHA512
02030ad8b25e3b4a26bc970dc27bc611c53aeec004bbcd9ae28ba266fd4884ae703b206d1bf6cde7e36189dc5a45855fdfdecec7d2c011007f6164fd17e61f7c
-
SSDEEP
3072:Dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:71SyAJp6rjn1gOObn4b6h9b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b230419f2cc3f4a871bf6f0ae32da722d1bc54c474ddd06c2671e0b1c99457d5.exe"C:\Users\Admin\AppData\Local\Temp\b230419f2cc3f4a871bf6f0ae32da722d1bc54c474ddd06c2671e0b1c99457d5.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5079622ae1483ed7af83de29d2e3578c6
SHA15c2b9ca8e30632dc465324e2be7dca5234193d78
SHA256253094750cdc1d1134574be4eecf447a7f3dadb927c18fd7c9f20d366157def0
SHA5128186df756e9546fdb38c78ceddfc1f445a5974f5065b06e463fa725109c18b6ab82d7d7dc0702bd7120d236d601cd2859f485757f1d38fbc7acc647f239c419c
-
Filesize
218KB
MD59de68f5ba04fccf6eb68422af8dde50c
SHA1ec4f7b159f1888eda91d6cdbd17db2eafd3570b4
SHA25680f3003e5bb04e63eba7039b6ffed96adeb72aca943db3ef32f6dba08f39796a
SHA512a65d26a6cf94722d2a5c7ed8fb105b05c6f6a57928d34786f6418f9052fe7505747ce85a2bc91f53a6f4b861624f3e2b8db0fb4d479709944a4be321fe5316a9
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB