Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 22:34

General

  • Target

    513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe

  • Size

    212KB

  • MD5

    935161e803404f4db2f2ee25727e1c1d

  • SHA1

    b712fc9e2b069ed2ddff46dfc01fe47cc082c0ce

  • SHA256

    513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd

  • SHA512

    5658549ed19ca9b1417871627f8c8c876f28da2c5daae05ad2b184fd95d79c1b872dc8bc799bbc36b2f2b6eab9eb46db20f385ed48a01441ed67b995bfc3ebd1

  • SSDEEP

    3072:eGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:eG/iVkO20SFgBhxtW9mG9+Umt3Ezjb

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe
    "C:\Users\Admin\AppData\Local\Temp\513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9348.tmp

    Filesize

    24KB

    MD5

    90a84b7b9fe297f09f0430fadf521928

    SHA1

    d016a4cedd9bdeb7b97969db59c507b907e427d5

    SHA256

    a891516690ab78c49945fdb1de92c1ee9a2c5da3d27f0bed3da2577a95828083

    SHA512

    408a789b5bc56c7ead9706b9a4ecc10ade38ffd80570d1551861a56572037e0bb195ae4ff930a64ab8219a7f883c33f1197799b734751af68757605d9fea6cdf

  • C:\Users\Admin\AppData\Local\Temp\93EB.tmp

    Filesize

    1KB

    MD5

    b3ce9a7e8b8d942385b3d188d48c31d3

    SHA1

    cfc3d18d17e0e03d503bfc7413aa8ae37fa75659

    SHA256

    58858ec67b5b7c0d70c807f52517705686ae440e52867664ef2221cb74f3450a

    SHA512

    7d69474cc14b256c34278325299746d0170e5ff2d9b9f2a893a8b58ab47c8c60374f89838d5412bca04a185e3e7ba6537c57a6ef33eaf47e011cbc9bd063071c

  • C:\Users\Admin\AppData\Local\Temp\945B.tmp

    Filesize

    42KB

    MD5

    cdc0ae7c1a9dd9db41faca8e74bbc471

    SHA1

    bc60a72d41c5b1002e87bbdc014a1f45913b9852

    SHA256

    1a4ff8c67463703766c37c971c63a6c34e4abb4529e34e05d338184cf908dabc

    SHA512

    2fa764f39103be5dbb96470203f8189a358aa1121978929d20bfc4b7f1d981b626609a8883efe3e0b50c27be9cfb1e3fc651377b1865fa21df79f23652e9e600

  • C:\Users\Admin\AppData\Local\Temp\D156.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • \Windows\AppPatch\svchost.exe

    Filesize

    212KB

    MD5

    985b247e4d1b01f4cecbe1f2daa71af6

    SHA1

    52ee1f0192e433a9b44d381208f059c207e1d309

    SHA256

    1f86b39f6afb3c9149a92006a99e8fb10e631fcba6e8ec57dc354ed838aa189a

    SHA512

    7fcc1d0c62da7c84d1921a85a137b1973778b2fe10d56aa76b33075eac2b73b79d1848f5f7b8f0c8eea70a8cc693036d4290cb8a7d96f44b493bffed710286b5

  • memory/2056-64-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-21-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2056-63-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-20-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2056-32-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-30-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-33-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2056-28-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-22-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-26-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-61-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-36-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-38-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-47-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-58-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-76-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-78-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-77-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-75-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-74-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-73-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-72-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-71-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-70-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-69-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-68-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-67-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-66-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-65-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-62-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-17-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2056-24-0x00000000023C0000-0x0000000002468000-memory.dmp

    Filesize

    672KB

  • memory/2056-34-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-60-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-59-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-57-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-56-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-55-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-54-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-53-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-52-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-51-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-50-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-49-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-48-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-40-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-46-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-45-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-44-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-43-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-42-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-41-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-80-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-84-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-83-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-82-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-81-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2056-79-0x00000000026A0000-0x0000000002756000-memory.dmp

    Filesize

    728KB

  • memory/2432-1-0x0000000000310000-0x0000000000361000-memory.dmp

    Filesize

    324KB

  • memory/2432-0-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2432-16-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2432-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2432-19-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2432-18-0x0000000000310000-0x0000000000361000-memory.dmp

    Filesize

    324KB