Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2024 23:45

General

  • Target

    6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe

  • Size

    196KB

  • MD5

    4972c5a8e8bd143dedb784dd94a683bd

  • SHA1

    5078fbee694cc26a1760c7bd2c879402b8a277ca

  • SHA256

    6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd

  • SHA512

    a21ca0550e600a4d82836d7e073c49f4fcccc21acba2f24a02b587f5e938218e4b3165682bb66abc1d2f04978b41b4a89d80b6ea2cfbf2331f35eaa5e9356210

  • SSDEEP

    6144:jc6BtUaNMtLLowRg4uLhuMXUk4m5xnt0Vu:jjuaWLJgzLMkvou

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Program Files directory 36 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe
    "C:\Users\Admin\AppData\Local\Temp\6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galynuh.com

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Program Files (x86)\Windows Defender\galyqaz.com

    Filesize

    98KB

    MD5

    9de02cae35488c80de00de4dd32bdf51

    SHA1

    ecdd681f860cd6f544302c99d40bbd492b759dd2

    SHA256

    e42e22ac673056ba7f77ea63916e4b90dafa17c916d65a0ade42102d862b97a7

    SHA512

    8dc51b7ec0f21c7c2cc3ae0dae97aa6ead41c8211186f3f459f44c95fcc78e77254bf6541dc7deb3e964bd8105f88cda68a6835bd7f1bfce5a1adf9769102b50

  • C:\Program Files (x86)\Windows Defender\lysyfyj.com

    Filesize

    481B

    MD5

    39ad5a8bdd73a62547c02b0f7521c351

    SHA1

    d7e77b2e2f3c33d6b7b1899f6ad99ac68cab6d9f

    SHA256

    e309a2983310b5f196db235a0f1b14ed2191e90affb4d654d45f29703681dc7e

    SHA512

    4f0fb7a28fe845a37766889b92f73e83326d1ee3dfe62c952cb66e7823008ddba2226a63d10afc5faeb5df4bc90aebd576d615fc03f9d2ae5568d329a8e2805c

  • C:\Program Files (x86)\Windows Defender\lysyfyj.com

    Filesize

    481B

    MD5

    6d9a44926474cfe63ebdeb79a722f33d

    SHA1

    5135bf5f5cc1e69f5341c7f8ef49878eda1ee1f0

    SHA256

    89228d359c97f6aa8eaac620f8e4cc639a6ed41f15776107bc9845b5e30d4e6c

    SHA512

    f165817e8bf3489669146b19d35583b73d7050579373ed6659a479cfbfe40748cddfbac49c35b5f28c3389194910b1431c7919d5bff710f551bf70e4a18e4623

  • C:\Program Files (x86)\Windows Defender\pupydeq.com

    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\login[3].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • \Windows\AppPatch\svchost.exe

    Filesize

    196KB

    MD5

    efc8be7a2aaf9e5b7dfd1524d4b5294e

    SHA1

    f9b5f624913643c4be8267d24876b6c276b80e03

    SHA256

    3248d21eeea6d43c2a8fb7538fb4d477f429a3de5af14beaeb5500afb45b2c0f

    SHA512

    33fd1f838c0672d4654761998c9c89a14ea8e3c1b0d5bea4b77fd9392a6ef02bbaa5006fea031babbae4cf889b3a0b1fbd971d141de52dfd44ce59d66f910db1

  • memory/1980-1-0x0000000000240000-0x000000000028F000-memory.dmp

    Filesize

    316KB

  • memory/1980-19-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/1980-17-0x0000000000240000-0x000000000028F000-memory.dmp

    Filesize

    316KB

  • memory/1980-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1980-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/1980-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2968-77-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-68-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-32-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-30-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-26-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-33-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2968-24-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-22-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-34-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-38-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-36-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-42-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-52-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-69-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-84-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-83-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-82-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-81-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-80-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-79-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-78-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-21-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2968-76-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-75-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-74-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-73-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-72-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-71-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-70-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-28-0x0000000002620000-0x00000000026C4000-memory.dmp

    Filesize

    656KB

  • memory/2968-67-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-66-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-65-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-64-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-63-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-62-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-61-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-59-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-58-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-57-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-56-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-55-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-54-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-53-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-51-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-50-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-49-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-48-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-47-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-46-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-45-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-60-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-18-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2968-20-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2968-44-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-43-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-41-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2968-40-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB