Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/11/2024, 09:55
General
-
Target
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe
-
Size
355KB
-
MD5
44cf7dd8d6409d75db36c31c3ab4fdbd
-
SHA1
bc5a205df09a32e5a38f22a791510de6b12b96c0
-
SHA256
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f
-
SHA512
8a815f3ab5417429bc0437191e8866aada6f89c9cef3cff46c1b6f4a3b70ce6e5119ce03e0e736aeabcade008790274b2af247c87ef6ddd098f27446af4af057
-
SSDEEP
6144:g3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei6:7mWhND9yJz+b1FcMLmp2ATTSsd6
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
481B
MD50ed0ccb57383fd96c2a909e4d2700eb7
SHA1f1a0f78b5eb66faae63cbbd74f24a1d1738b9c1c
SHA256aebb7059603e5f14c38ed4db5cc40e5a1f196d74758684dbdca1e5c89667e802
SHA5121f69c79ae7db8efd0b67c263dba07933d5283eb0aa4cc4be0d6c58b4e710b1713025e3ef30005d7c1b6ca1c562d3e320dded8bdcac8c4231b44ef30f4230c3a7
-
Filesize
42KB
MD57b969edb141cb84bb366183342c1dd68
SHA1976e4ca3c059764863fc62a312fcfeb493a6b463
SHA256ef9702249b5c7060b9691e07e1515f8701e257997a015a1e5e63787069dd9155
SHA51213fae4e8a26d4d4e4e0d42be29ed4ffa242d5bbee630ceef0f433a5824559a7bf8bf954b75464843a8141ae16b7f65273cc63f2e959b72fe06e9d3fb7a947268
-
Filesize
42KB
MD576163425badd22b5b30d2ca7e34c5df2
SHA18a88d82f3423236aeb2018eaf357b7eb38d43164
SHA2561a1ccf3275b5bf67ee0a74bd4cd2350d344926e2ff1c5941df89fa40e1a55022
SHA512037b5db5a20b14ce8e69b846d1ca058118870919d3ff75c3719912603757e5d8ca19257ebb6ef418f0618a4b229363311c067475f8c052a4b8e4437a2b9edd42
-
Filesize
481B
MD5d476976481b0dac1f051cf2c0981e17e
SHA13e91a69d9a02d21a7e2dda4e6de908dbdfb8c48a
SHA2562cfb1585c2b88410fb2d4f742febd0d666cd72381ed0e00561498df12290dd8a
SHA512775f2924ae5dc8665232f8d8a85e009fb6160dba38a95275417aeaef20ec81e2ef4cb70d6ff80ec8ebc258331344e269d39cd17b06ed51d7f5f98a880c2c96b1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
355KB
MD57a308f82933594b167101e19321be21d
SHA182c326c14ba7826730828557d1dd242003c11ccf
SHA2562d2ee2392d256841815289bd4af7bebfd5860db2e7d900d05769a59b8625d7be
SHA51243b69d4236c95d8c192441c79999b4e291f819da6fddffd37b526ff2a66bc5669a91344be9a1228a725281029d52a39d88ab5b8959112b6b9ee2f64173a36007
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB