Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/11/2024, 04:41
General
-
Target
6e3212fedfb2893c6951811b4dc97a21288848cc4987517f1bbb95c141225cf8N.exe
-
Size
212KB
-
MD5
1ac7ecee36545fe41fad4a7eddb2acc0
-
SHA1
c903a1e69025002a6f40f09ef9201b47cac437c3
-
SHA256
6e3212fedfb2893c6951811b4dc97a21288848cc4987517f1bbb95c141225cf8
-
SHA512
4fc399098fed8a51ecfad06fc0dc06e943aec63fb2448538d707aea6ab17d77ab86d5818fc60d27864b4334cc71740bc678e661b8c38eb509a152db027f8445c
-
SSDEEP
3072:fGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:fG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3212fedfb2893c6951811b4dc97a21288848cc4987517f1bbb95c141225cf8N.exe"C:\Users\Admin\AppData\Local\Temp\6e3212fedfb2893c6951811b4dc97a21288848cc4987517f1bbb95c141225cf8N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD53202ae712e01c1439a5de95272e01e31
SHA101ce89e537decdf5415256915426c777b34c7be0
SHA2564417438f10024944a7d8ebde47c3345ffeaee0d206b31924212624f9f897312c
SHA512ef37335a75ca49a5bc4d618ac52913c03dcc9d80d38ad6312d6b691aa0385b508044fa102cf5b2623e1157fcbf080f43903a8d508cc73b74c3f4c155614e0208
-
Filesize
481B
MD52f96cba38521afc9ee13e8d2696495c8
SHA191eff322b55b1d0a8c0148529ff44a198fc6e414
SHA2560ce7f6e472894d1ad0c43fab22cd584e111ecbe9b54d1ca95de258679a16bb64
SHA512574a04e19fb53ee4aef428709e82d3553d0a2449d930ef4d8297bffadd26d678f78695c2aa7a5a6d886d4b565913ef92769daff1c11c1f8691e16f58054f1a0e
-
Filesize
212KB
MD5a686f230d533771ce635b4c1d41e09a4
SHA1989ad099b1cee78b744e406214c180908573c2c6
SHA256d3e58588ef7bb35d9d8f96706113a612ec7ddffdf9a864dac2adad63ed9af14c
SHA5124573774f8e0767495d54c47d52c1b4ff6a067a71613b10beb392dd711b312da5a61d237b842bf6002d3da6e9145d3811aef237ff325991892a8801068da73795
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB