Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 02:18

General

  • Target

    91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151.exe

  • Size

    218KB

  • MD5

    76396a70ae28b095e4b3386186293a38

  • SHA1

    6d9582554eeb6c44e2d2f58921c0a0f5b73b82b3

  • SHA256

    91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151

  • SHA512

    74968ddeb5f3994aacc7a29a574dca1211916a600fef9d8318a1a8e41d6d5a1b4f9a8d8d72321b7b848d560f70967bf2bbfc6af049053d3c5b926e42fdc94e67

  • SSDEEP

    3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9h

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151.exe
    "C:\Users\Admin\AppData\Local\Temp\91f6decbef6b9e8d950ad6e4d3d8e79840f26653b6a2259a957dc6295118e151.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9BE6.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\EF74.tmp

    Filesize

    481B

    MD5

    d9c7ad00cf266fd10e8b495d7dcdda31

    SHA1

    a37494280565d672a99ca316dd7c38372a3c42a6

    SHA256

    17856b7f743abc0b598f536ecdb7027fd265ad5aa12d3ae1cf5429d68f908813

    SHA512

    70e4af5937d2b87f669cdd25ed9e720085836f4c782dbaa857fc9ea57998e39adc550fc5e2ab67b7705d70660d82ee9f8ac90281194c25b36e4cf2fe6c491778

  • \Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    e67a77dc140dc80ce993c8be60a6348e

    SHA1

    d711258cd081b35aefebf4fed3aa1e7c4d21f2f6

    SHA256

    1c59f9645a21368cf1285dba5f6854f8d042a126f5350737f71f275be9cb0daa

    SHA512

    459c0b9d0cd91320e905df2c3adc4734c104e1c3a3dd9452d3724510349f28a231f5750cdd7e0c3e6175779650462baaac99588cef549b5ae81ee360f8968e47

  • memory/2668-0-0x00000000005B0000-0x0000000000601000-memory.dmp

    Filesize

    324KB

  • memory/2668-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2668-17-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2668-16-0x00000000005B0000-0x0000000000601000-memory.dmp

    Filesize

    324KB

  • memory/2668-15-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-73-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-68-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-22-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-30-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-28-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-31-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-26-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-32-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-36-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-34-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-38-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-42-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-58-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-84-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-83-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-82-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-81-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-80-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-79-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-77-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-76-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-75-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-74-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-20-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-72-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-19-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-71-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-70-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-69-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-24-0x0000000001DE0000-0x0000000001E88000-memory.dmp

    Filesize

    672KB

  • memory/2840-67-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-66-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-65-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-64-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-62-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-61-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-60-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-59-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-57-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-56-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-55-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-54-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-53-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-52-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-50-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-49-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-78-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-48-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-47-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-46-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-43-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-63-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-41-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-40-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-51-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-39-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-45-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-44-0x0000000002560000-0x0000000002616000-memory.dmp

    Filesize

    728KB

  • memory/2840-18-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB