Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/11/2024, 19:45
General
-
Target
0f5737ffdcd3fcbb79f54c55d1278fe90e1b98070d02718f38c1dc0723f3fdd0.exe
-
Size
686KB
-
MD5
7ea368da6575ab0d985025714f069b3e
-
SHA1
b9058ef549ddc5f682eba47167bff93a22dda756
-
SHA256
0f5737ffdcd3fcbb79f54c55d1278fe90e1b98070d02718f38c1dc0723f3fdd0
-
SHA512
bbc3791f5a8e9154c4d648065e68579ea9daa911c0738dd17825c0fab5120daaf18f103eae4a1424f5f35666a790a7001308ed2fbb4a71c64f56a29cb467e709
-
SSDEEP
12288:3mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:3mUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f5737ffdcd3fcbb79f54c55d1278fe90e1b98070d02718f38c1dc0723f3fdd0.exe"C:\Users\Admin\AppData\Local\Temp\0f5737ffdcd3fcbb79f54c55d1278fe90e1b98070d02718f38c1dc0723f3fdd0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
271B
MD583eb358d93a58a5515d37544731c6c51
SHA1eed72863382f3f9845dc020dcdcf4c7656d619f3
SHA25632d53f571a785269aa1d589299b1e02697b49130cf3059e8071a08a9a946b67e
SHA5129eeff293218d0a5bee5932473c582d3eea21a20dda4afb0d44df38831da01a62eafc41fa1f15ee7dfb18379a4ef4b0327d88a78ddff270c8714245e64c88e356
-
Filesize
481B
MD5fb75a13077d6f73cd192bd245e13bdd3
SHA1752d74a2e385ba763c196051932397db9ce925a7
SHA256c147de40bc7c2e04bbd5615d9410cc3fd8fb7e7d360714626e88e68c3ab3e1aa
SHA5126d5c8fcf10b303bc81acaa5464bde5f2cde01ab83ef766e644be281f1e6e41b45e1315269f6d09fd000ac2ac02ddbfaa10dd137987a149d3215334a506f9c201
-
Filesize
481B
MD560ebd99396991bb07c8ea993ba9fb133
SHA17e077c16445ade9d23f9d9ec566038158c9ab010
SHA25688e993e81e64b13e43d2bc7e864dc5d00f6027ee4598cc64c21ef9656ece936b
SHA5122005eb2efd8dbed288d8962833b14160005121e86f5aac4c908a16f184739b0af8b60102ebf6b03b16a6d519cae977560d1b35ccf6efe0f4040821d0b08ade20
-
Filesize
686KB
MD53d1fc4a4e48f91c34fb65ecc15bb9614
SHA16f9627fb697ae3d81387d41a68c8f5d0e1ebeb17
SHA256f4e1b811a9c5befa038bfba68a45151817682ad551ba7960406bb6c04fa84f14
SHA5124d09536273abb85e2dbb6fdd051e48445a4ba37aa15bddf336f979f590fc029c465bd103890a93865658f6f4448529a1b52e6a5873e2f9cb9fc0a11990319c90
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
732KB