Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/11/2024, 04:02
General
-
Target
c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe
-
Size
212KB
-
MD5
57e40a37e55f737b61a5693dd90329de
-
SHA1
2f80a18b3441a5af6ec79c7e707386d9ea3a5ddc
-
SHA256
c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e
-
SHA512
5b9721fbd78328a074ac7f1314977744e01395f3492067b974c7886e879461e3e53d7c261f3c86fb3f1fe95fe6c1935f438ed91fe76c387d1a0bbc9d5e8710fc
-
SSDEEP
3072:AGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:AG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe"C:\Users\Admin\AppData\Local\Temp\c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5884ff20c0bff09cdfb31fd10dc1b8bec
SHA1b4417bf2aaf96da4e914aa28baf2c8ce349202e9
SHA25660b641ae20ddc0843a9e4a880cfe7163a89ee8f7be8659bd8a7bc0595b565c73
SHA51246db5d189e661736c3017c1f1546ce02a85c7fe8cefc53c70f20a41b08ba872e8fb5f1f948cba8d521eae7f29581c7c2894840ecda18b7823ccf693f53064bf7
-
Filesize
481B
MD5f834265ab49e7bc88688a21bbd49207a
SHA1be3627ebc39e6c04477c2c70cc45370e36344be7
SHA25691922a3e4317e86fffd6f487a7b15c19b6f5e69c7ccdb1aa661c1e28dd943197
SHA5127dda2fad360072ac1d9950016f85b2a341e10b5c48f0079bcb4984668b82bd75be98f5fef890a0b24b6aa0e61782a772e96a0d305f8525b9813104c59251f5e7
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
212KB
MD5ccfb62a7f15588681e6bfede632e7285
SHA1b06058a2793afeb45f3ed9ec45c0b432bbce5c33
SHA2567db4b472acf6b49bca98ff1c2cc66cba86c01e616856eb1cf7df37f9ed3577b1
SHA512e6933485a32981b2da7d03c778a3526a27a388575d5990bdca0ea74c3c7ef29474daab4b83b31cc2409e237c6e04464541b074d1a1fb4f330aba0d546672dce8
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB