Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/11/2024, 21:27
General
-
Target
30edc1fd5a468c4192c769ae3e5182907d6130eb3911bfa39f22ce7e56d98e1d.exe
-
Size
218KB
-
MD5
1305e50ee435c72991df76ae2dbacc8c
-
SHA1
ae02864f0fc8e4e8dbae1a9fcc317f5347fb9fe1
-
SHA256
30edc1fd5a468c4192c769ae3e5182907d6130eb3911bfa39f22ce7e56d98e1d
-
SHA512
972759d4f8a3b98592fbe86533a493bbfbec29dfc0b5a761b0fcf0a7bf2cb8e1eb28596ce30e9c1e8d21b79e158701418cb6b43ef59cf321edf17fa0bc2a7887
-
SSDEEP
3072:uvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:w1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30edc1fd5a468c4192c769ae3e5182907d6130eb3911bfa39f22ce7e56d98e1d.exe"C:\Users\Admin\AppData\Local\Temp\30edc1fd5a468c4192c769ae3e5182907d6130eb3911bfa39f22ce7e56d98e1d.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD52a71f6c1205a4f325779ff61b9b9b43f
SHA123f67c1fc1d419eff76b70f7564f90ffbb57b4d2
SHA256e868539797ca8bd45e0f431fa79e4fa2686db408edbea3dcabac8bd5d4c7805b
SHA51241aa6169b2adb05bf89046e1da03cc3f5d183f7138f3178b6768c39184ff0c65d9790a589bbe0e823059a972b4052b1968c048c0ca02aee7661261f518c55b13
-
Filesize
481B
MD5bf44abc64b0ea2ee6f4d8f50305e381f
SHA17813d47c693936d7502c67930c88c08c85ee3c4c
SHA256a76aae2722802d95aecd74f06e542975dab9330b7bd1b1a793e8aec08ff1c50a
SHA512b2e729daf01b7b86ce8f7f5f180b69e8a2b40fe57984899a565c04f45c862cd2b33673a151f33a75152e20c819b7f2acae61b3c6ba6578f14d69e313acf5ef87
-
Filesize
218KB
MD53eba3bc727a14bb6d2911a89fff5a8a0
SHA1af046ab820607fcc0b747370b65ef4172b33d53e
SHA2566811f8234c8cec2c6e2ec6db43f8ae2a90ad2b7d1cc9215262fa87fb980dd068
SHA5129b35d530a9c5973d92507e99044598bda56be8f37c2a265630bac586e26b6a4b42f8eef9f957fb8c5977f3465b85abf7d4381290bed2668b1ee0bef1c8852067
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB