Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 15:58

General

  • Target

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe

  • Size

    208KB

  • MD5

    85a275b7969afee998593f452493cbc0

  • SHA1

    2a69b28ef5e41cf580406c877044e4780887bf2f

  • SHA256

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310

  • SHA512

    9e1f4c05501f6579a646b346bdfa18a2ed49fb8929630dd0b59fe1d15bcee0163c5e659b3ee377493fa8a0be8d72d4ebedc8b8c284a2fd7004ef7154c4a64769

  • SSDEEP

    6144:qOYX27lPBA3YDMw4lj6idlMlwl7/79C87:qwBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\546B.tmp

    Filesize

    24KB

    MD5

    bcb3472bb49eb6bfd6b407ba5c2b98d7

    SHA1

    3560ffd5b4bf89e7b4d799e023082500f934bed2

    SHA256

    b9ef35a6f037c15fa5d04438281f69c54a876f32d3f407bce4d666e4ad3ad478

    SHA512

    d196a07b864416fa18f6a168c0d67d35cf33c82240b0d86d40e1492b02e43ac0722a89e31fd240eaa34b86973721bd8d6e776a47541c3504e0ac6b38266a791e

  • \Windows\AppPatch\svchost.exe

    Filesize

    208KB

    MD5

    a9d82ccfe3b8cf7cf7f6604abd3b7af1

    SHA1

    bcfb6336fa7adbb0e9e7dc538c8f634560c812ed

    SHA256

    9216c78bbfc03507925dc4412cfabc62eb31b204f1fdac1be0dc24bec23cf12c

    SHA512

    584741ad9a376cb11d64d10108b74b3d6bda32dffdeaed518ac41bf10228327a6e1241b6ce4f158f27d841af4b429508316270adf1684c4c71e9d715767c2043

  • memory/1940-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1940-1-0x0000000000240000-0x0000000000291000-memory.dmp

    Filesize

    324KB

  • memory/1940-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1940-19-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1940-18-0x0000000000240000-0x0000000000291000-memory.dmp

    Filesize

    324KB

  • memory/1940-16-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3024-20-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3024-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3024-21-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3024-26-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-32-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-30-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-33-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3024-29-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-24-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-22-0x00000000022E0000-0x0000000002388000-memory.dmp

    Filesize

    672KB

  • memory/3024-34-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-38-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-36-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-47-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-60-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-84-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-83-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-82-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-81-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-80-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-79-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-78-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-77-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-76-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-75-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-74-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-72-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-71-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-70-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-69-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-68-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-67-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-66-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-65-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-64-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-63-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-62-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-61-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-59-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-58-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-57-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-56-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-55-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-54-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-53-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-73-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-52-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-51-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-50-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-49-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-48-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-46-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-45-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-44-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-43-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-42-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-41-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB

  • memory/3024-40-0x0000000002880000-0x0000000002936000-memory.dmp

    Filesize

    728KB