Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/10/2024, 00:16
General
-
Target
b23744a100af37d4345cec6b22c06624d1d4ba35048f5fd52af9e722ed2ac217.exe
-
Size
399KB
-
MD5
611b82b0c3d93b1f9f4c55a4b9e2d81b
-
SHA1
7ec53e5823cc5704be55d4ea7b27330a30f5d4f4
-
SHA256
b23744a100af37d4345cec6b22c06624d1d4ba35048f5fd52af9e722ed2ac217
-
SHA512
650fee29c4f9dc3f0141963b129f294430c4dcd49a11fd367d3accad39629714140ecd2bb49b49cba4f81705013150bc1bc6847cf251cfc3805ec5e58ac8e75c
-
SSDEEP
6144:D4EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eir4Xd5Md:pmWhND9yJz+b1FcMLmp2ATTSsdr4NW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b23744a100af37d4345cec6b22c06624d1d4ba35048f5fd52af9e722ed2ac217.exe"C:\Users\Admin\AppData\Local\Temp\b23744a100af37d4345cec6b22c06624d1d4ba35048f5fd52af9e722ed2ac217.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5eea5fa54a90a1755fdaf70072aa8b2a3
SHA1b3ec4d101c09ff749ecb5982e98cf726c7820f69
SHA256bbf7636ef0248049f57494f2750421a79a101be328c9b0f7472ba14a64100bcc
SHA512063d50d81061f18dc7cebbf8fe747d7ca3cf2e43758431802423fb4a0edfbdd9c1b8b532671f548ea8ffc963400abade69c72600c39412eaba40ec114ab700b0
-
Filesize
42KB
MD5ced1c1b4b7b3c27e22407ed93b652bb7
SHA1ff608c48ea1de3d2e0a0f7334278ce39ef2ed178
SHA2565a2be8d39fb76267c71e80c1c7ae20b3c537ea7a73f4910a9e5f053c257f9dd2
SHA512280ecb20f7995973062cca3324d3e9109b8d9d33746fb8e51d1e1b9e8eee734c5ff1694afc9c1e75c528b7a8262154fbc9c03117b8a303bfc49cf5b7911ac0bf
-
Filesize
24KB
MD5670572cbcae55b7f8c903cbff901cdca
SHA135a3e5e85201e66b04f963c026511e6b00f38925
SHA2569574c5e598964e8cce67b1ce66cf8bf7f5c66fd4801712ed6ecaa43a1279baa7
SHA512ce30d8f1e851a7424625c31c804e93c737bcae0b56cbc0fe205e494cadf1f2ef5a94a8371e4e1c6a6d2c4c53b637341a265c794299b16e6317e6deeee2399a6e
-
Filesize
2KB
MD58e3febeb336b4adfcdfc47d0757822fe
SHA1178ac42e8edc27789235cc11f930a3df8ab298aa
SHA256e4d3097f7738468fb6a8a4bc4475e3e3247d63753eae579ce6b58d30fecfdc1e
SHA5122970e03b11ecbe0a7cd508ca6088edd93fa91a58da4f60aa4b03eda1d7e7f61d7824641da17d53486b903fae791ea62f802508fcbd6c75adfcc92be57092193d
-
Filesize
399KB
MD5d67d2287b012f377826ced6b59d89cbb
SHA1fab2db4c69815350013bc0d77c7ac55f309e5a90
SHA25698bd753e2f71a606e51d5be21c56f2a7cdf18a5f257ef972e922d1dd51473759
SHA512e85e06a8409f2db1c3594f1e4285eec3175ebe7f593ca5eacf1e32ba62043a341236fc868bde0c9474daa9297b668969255e3302d717be19a20a6dd5f42e8ce3
-
Filesize
424KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB