Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 23:29

General

  • Target

    659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe

  • Size

    375KB

  • MD5

    c0a9550ada72409c9f9de8c259bef404

  • SHA1

    a3637703ea7a9423cb75d6d5b0cbfb97ea465337

  • SHA256

    659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519

  • SHA512

    46de6ae2b96716759d5a243a2af0ed02067a7fe367701836896fd356def976fd97a4bc138bf86b641ae5aaf6435d9b3fb2d7e48765ce4f0ba997350b425e24c6

  • SSDEEP

    6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:emWhND9yJz+b1FcMLmp2ATTSsdU

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe
    "C:\Users\Admin\AppData\Local\Temp\659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:328
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\C8A7.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\ED9F.tmp

    Filesize

    24KB

    MD5

    9ae6600b5f17deffa200eed4f45e3e8e

    SHA1

    c45bc495f8d7c1af9c1592cce86798bf21246d56

    SHA256

    2dbce4a1486d453cd0ac1bc34014fdbd3a7e0bb7ae2fc2f165f18baf16c8cd56

    SHA512

    4d5ba5b5901395060c6b1c4b7943f89f32d9d7088a7baba367af97299abe7b7f31038bca24b1d96735d9aed947dd1ab6e7627b49993e9912fc9188bcd5e2c261

  • C:\Users\Admin\AppData\Local\Temp\EDCF.tmp

    Filesize

    1KB

    MD5

    9aafba10824a859adf90e737dcda0a68

    SHA1

    3707d2770e1266532e44c2717806f8d4a6aef4fb

    SHA256

    297463067f6abe236a9af157fba3db12217b4d9e232d434b3f827232dc6daf35

    SHA512

    89b5c486f0293f6f1fd2767444398222154c0ecf91a5ab00bf57c133fe509d0572fee55867e77456efcec2edade2c7d8c2189fef6d35d8ba67da8f7e35586fbb

  • C:\Users\Admin\AppData\Local\Temp\EDF2.tmp

    Filesize

    42KB

    MD5

    ca5c664eee9dd93514c743025ea399b2

    SHA1

    7c91aac271494a7aa47f9a723c65ebed040cb68f

    SHA256

    c89f2a3e2f193dbd0c4d30ecd39b22f47bf0b0bb79ba69994b23068de3b9371a

    SHA512

    47d7177e8008bcd3ba5602a858453a6003e6e4540d1056690487db719e3cc61446be75f67219083a0703d1eccabd92735016f691d820739c311b06781049d79e

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    375KB

    MD5

    208735dcff3d6728f3a1c5ebbde7ff09

    SHA1

    cacf08e985ba32d903a452ad9e9557301e734384

    SHA256

    bc0c13dce7bdfe5d502d14314f331c24d1b77f22effc6ba46b9befd202c8b643

    SHA512

    63550ab527084c9bd88f3669498ce0a3cf29d3f084574e06cbdaf8c11179a53b956127fc5a9ef641b7d798f32f973f100f1d382618ab532f93b0e102f6951995

  • memory/328-0-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/328-14-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2780-67-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-28-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-27-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-25-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-23-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-22-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-63-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-32-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-30-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-34-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-39-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-61-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-80-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-79-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-78-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-77-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-76-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-75-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-74-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-73-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-72-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-71-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-70-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-69-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-68-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-60-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-64-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-65-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-66-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-19-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-17-0x00000000021C0000-0x0000000002268000-memory.dmp

    Filesize

    672KB

  • memory/2780-59-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-58-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-57-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-56-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-55-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-54-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-53-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-52-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-51-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-50-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-49-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-48-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-47-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-46-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-45-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-44-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-42-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-41-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-40-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-62-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-38-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-37-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-36-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-35-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-43-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-206-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2780-207-0x0000000002370000-0x0000000002426000-memory.dmp

    Filesize

    728KB

  • memory/2780-16-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB