Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02/11/2024, 17:02
General
-
Target
ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe
-
Size
218KB
-
MD5
981fb6702036e36bfaae20bc333177ba
-
SHA1
2a9e340fbacaaa0bcbbd6568f47ff17977e66ad7
-
SHA256
ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666
-
SHA512
7660844cb389ed8c41e09301b6a267d256eda1a6117c4491f2d5ea8199972f85a4620de58f707bffc7372861968bab12422eae3cff0e544d7b2f2d8333db13c5
-
SSDEEP
6144:kEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:kEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe"C:\Users\Admin\AppData\Local\Temp\ed689f99d04c6cca8010aec6288493f319edb3d4846c82f43319cd5bb1b2f666.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD586a84c06fab9d8a150cd5ee81cd21d57
SHA124afabd7612aa231d9086169a441eb60b8a9a00a
SHA25677e869936306742fd3aa2057a1e427f25d19b5e74ea7cd5da472edfee616f8a2
SHA512c7e25b5505bed9b4c23c2d67af49f2290d37112c88e9e8d140c8e2074dab529cd77c42e71a89938a7fed6419bd72300b33417df33b3b6d6da636f444307f4110
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
481B
MD53e00495ae4443f3eab70f7260cc7cda2
SHA1db5772f3880aeac4d3e1f3dcc0834f1c5e825348
SHA256e736ba25851e735688a4ebc46bca15f5e5e442ec28a4c67cadec6cd4a678a613
SHA512afcc60db8de065674660b2784d4b87fdb2deb3ce8167452bad1892ac6b45660839777237f66903f8d256e7a2df82f1fbaa179315b9fe79db245e98b027ff6139
-
Filesize
42KB
MD5f49642b20d0fd0487270db54418867be
SHA1430ac2a0d21d80c025f13289a116ae2bd7422f8f
SHA2560f55b3158272d93481671404be796368ea4f90565fdbca85483fc21f3bf27a49
SHA512f1637f9f66d7cbcd434270d7bba549c4692085dd3ed4433bec0c1a2d01121d037c4a3fb578c9e5b64118e14f73d1b7e2cb5eddee0244b75d8b927d2b65c9d0de
-
Filesize
218KB
MD58b6f871141f3233a3c46f6294532737b
SHA11c164a8e39702b4894669036c28e1a0b2fc3e6cc
SHA25684f0b439ba89fac860af8245cd66ca60b29fa0c9c5412f087b84230bd3c8e602
SHA5126d7ee3931fa4fabed679498904d65e583d14ad357f9ad2015d66506c637024870b4cb01fd48d9a9e54c1f26b033241112b00353679d41eec59d159089c9c89ac
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB