Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01-12-2024 04:34
General
-
Target
ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe
-
Size
208KB
-
MD5
57b8a762f74a81e2b6d39487ced997a8
-
SHA1
c5200b1584e498d8ea3596085031cd7cb2208a4f
-
SHA256
ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637
-
SHA512
7eab54cec12144320c3256039c50430abc75d8ebdafa3ed304769ccbd9fcceab9730eee2ab4ae9b4639248cc7632f8b44d4870303314e05251adc6f25e97390e
-
SSDEEP
6144:4a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:4bapK0JCmRcU9vVokfp
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe"C:\Users\Admin\AppData\Local\Temp\ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD58f4bd024ff69afccf80469ad43511c50
SHA12e6fb75fea3c75828a5f514ab9695cda04296891
SHA256c341bdd34c813a7aae387fd47cc7ef15db5a3ac109c33195baefa631d2769205
SHA512c12f63e484c2748e77091905d7e3a75b00f8ae6c001a0b7e2051a24edf97d19910345752328361d6943044bc7b483bc048e7ebd7b62903e338d261897f69651d
-
Filesize
1KB
MD5a73e0ebc1d20f22c0000cb30bc265d9b
SHA141e35526c6131c4e8c19dadfd2f13b70d04f2972
SHA256c0ee81fdaba23f5d964554d4cc1d62d0ce067ef280fd47d61b9ce2c5b6a3ab77
SHA512e388ba92cc0196d63bd43d1ead9efb605d638f6eff4253c61aa96c0959ed49f45aa57bad7a0209b30446c7891f3ba3cb7d330632a0fc7bd3f77d88f1ec1da4f0
-
Filesize
1KB
MD5845ca93a8401c95a2e4fe0c4705bc5af
SHA147c6a963bc30dabaeaf4a47de5eafd82a25c0909
SHA256cfab4abc4b4629308c7e7f213ec19a5b99c17b312632c1ce3a79462f425e6cfa
SHA512e0f369c0a2f8d83227dd062fc5b75976e1042e3e1965e8bd3014499445490abd2f20d0c0ecc0c580779ff74cf0367ed7289b369efcfe0d2a4da38ba52987f217
-
Filesize
208KB
MD522c74df53c906890c507f88dafbbf1c0
SHA143120dc90e37f05a5c9f7cf581afe8c6d442bed4
SHA256e6a155de082706a9af5414b606412ebf94c04c435bd7bb0d4777a8d01d32a0bb
SHA512a9667d4086767b4e435d08e5b26424a9dac299874fbe0f506d4e1d8da98509541ee303b8c7eae1b35816196e8f5af9cccb3925192351c031f4e42b25bebc1e6a
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB