Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
01-12-2024 01:27
General
-
Target
9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe
-
Size
686KB
-
MD5
78cd7dc2a4206dcf360b50280ca7f5b7
-
SHA1
1240d870db37281563476427b8c358d7814ef6aa
-
SHA256
9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892
-
SHA512
b9f4920be52325d66f3c6f9f1bde07b11f22858203881b727ff98feacdb506387ee9e79508838f2ea86d6da7f96b82e27d4a7c558ed1175b916f2fe892b3d0a2
-
SSDEEP
12288:9mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:9mUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe"C:\Users\Admin\AppData\Local\Temp\9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD52893a1d37f4573b7d972ecc41b5fb2f3
SHA178a0fd08010dbf2d01e3a986ed60294e010c5aee
SHA256f02893b2203ec00192194178b683fda6994b9a6a1ca342c4a2f8197d2d905cdb
SHA5128bedfbe3cfe8975487322d419f5fc7536b14e7c9915906fd3928fc3c3d8e5435f7b8505cb828921e7101bd489d1d6a71f082caf6b42a3165547419c8d6edf2bb
-
Filesize
1KB
MD5e141cffbd0acf9ad91c5e22eea151f62
SHA102a699435d708520e06c4b3ce532d1b89347e7db
SHA2560a4c408c6e7db7f36b32ead03ce2781bfc0308b68079803a90f9a8305ee7301e
SHA512a0818bd2095f6b26ece516ef2d20ccc73534b4c70ffe63c25a33c6fd2e28f5c9de0c783982765ca2008f26b3c2af5306e3be517c4c8dd3c9b595b3e4e1532ce2
-
Filesize
42KB
MD50134190853701a2cb4437ab2568e601b
SHA1602f134f1e966b5a7bf0cebd01e729d25c612fc3
SHA256fa3647292f78c81add3511bc9755e703290b9249dd33e7d3bef40daf5614da67
SHA512e8f5575c5d656327af646ae9b939b545db9d8a4add50e262db3d7fc245dae396a981f24015107ef01bc8761e3d5e61c01da4f96a2c06c6332710961ef31b6927
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
686KB
MD5272d823a57a5d325a2340569ad0bc01c
SHA1fc9084e40d85d9d9f484fcd253f1d274066636ef
SHA256faa93500aea6c062d9d315c53ab7ff968a6f63bd94cb8681d8531e7d5ee14283
SHA512b477be7b80b92832ca45a608a99fdc5a843f94394ba73dea8ca28d1122c2da8718a6f1220a819e3947a205c5a84c4432dad6ef22557a38afec5673e5936ebfff
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB