Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
01-12-2024 23:53
General
-
Target
df4190e33b81a48a95b96ae47dff8d83a62929ec6ab3869e966d3624b5f2cf7d.exe
-
Size
208KB
-
MD5
c1ddc2c06498cfd26f0596850194f632
-
SHA1
a04a40af63ba6a08ce5b2fc2dfc3de5dc37086a1
-
SHA256
df4190e33b81a48a95b96ae47dff8d83a62929ec6ab3869e966d3624b5f2cf7d
-
SHA512
0aca6b579f39417b16504f0f42e6613106228caa41b8feee44c387e621ac40fc83497af152478dd0b683c35d5841c86d452c97ed664613828f276d53e4cd6046
-
SSDEEP
6144:sa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:sbapK0JCmRcU9vVokfz
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4190e33b81a48a95b96ae47dff8d83a62929ec6ab3869e966d3624b5f2cf7d.exe"C:\Users\Admin\AppData\Local\Temp\df4190e33b81a48a95b96ae47dff8d83a62929ec6ab3869e966d3624b5f2cf7d.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5945406e0a5584330090d72d6692bf38a
SHA16b87c6d582b4e8925a2d75c98a80ea648e49ae9d
SHA256936e52f3cbf1fc26c1305e2a82b803574aa1483956f097368fa2527fbfed499b
SHA512154a731ba246f24bc9553bdad4f5a033a53e1e65b7aa7a284717cd6a55373fc145c5481b6e1da60c779dd2afe79d99c980679f5ff79aad98435651c1f416bec0
-
Filesize
42KB
MD5941268d6c35d6640c98c43a6c3491153
SHA1b7ccd10175e93cbfd76dcad4e79d0274c3978155
SHA2566a8ad9cd96a7316f2e06daf7d6ea30458c7c84e1cd8ebd9bb169498b35250c55
SHA512d927f0729aa7364c4d8a0be5eff54d5876a60c53163cc4b33689be4657ed88e38ca6a0d1b7ecb250a2d06f1adb47523e434fd4d4623b2c0cddd47812537a6e32
-
Filesize
208KB
MD50e5af16d3f4cc2d7726072157b307f47
SHA1414b92f0a5b3820f7beb15d9068c94bf553b5256
SHA2560a134d1c32aaa77ccfc1d49283aad33c5fb0e2e33cc56131de2c1f425df209df
SHA512dcdbb0229f68781be4d75468ab9cd5b7c2db4495d84e8328dc22c638f8998884387e86cee5b05878a78d64273458a98c94dcf0b44914a66cad35f5da26f3a474
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB