Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01-12-2024 16:54
General
-
Target
01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe
-
Size
205KB
-
MD5
296722b7ad4be51557b5027d24a352f0
-
SHA1
1326930cffc9b9be0411b468ee09b5e2719eab4a
-
SHA256
01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80
-
SHA512
18c3ec716fa8a00475f13793c86061bd056ba20d2214e4bcbda5e088ffd8b365cc9a7c0cc4f6e470a6586ba6afb30ecb19abf89868931b91a51f14184b0d7d02
-
SSDEEP
3072:s7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:CzHnMLm5GNGxHUhtnkdpHqTKzhh8i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 26 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe"C:\Users\Admin\AppData\Local\Temp\01bfe9ccc59dbc13b289725b36830e5c17ac2e7a496ac4f06ca7cf0c73db5e80N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5b8cc2b4ca73411efdf98171538deb7e5
SHA1c4ef9b2e647b60d9eaf9cc4863d342f019c9844a
SHA2561c00d69df2a8c793fef2e3ff1cdbea2d125059e2dbdcc6d2dffea45a732e3ab4
SHA512a51863247bc9cd8ff010d23aa11e7319474cc6d1158ee56434bc3fc46a96f3bd5bd61bab7bfd3edcd89933eeda6b2705491ad9d138c45bf142e550339e485951
-
Filesize
114B
MD5bfde1e9e9c32c1681a16139450c6909d
SHA17e669b927e6a75a10a0ca29e38e58ddcb49b725e
SHA256e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a
SHA512781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396
-
Filesize
1KB
MD59266beb356cb2ceccdb1cbe10c3faef2
SHA1c809e41640bbd78f76887ce397859c753b5693b3
SHA256365066a2f950f7d9254db45519ab4ca82e8e6073ea03d1a1b23fb815b5b76fbb
SHA5123a25faabff7cf324b508dbb1e5ee4c45553c8fcb99116327f61f7743cab0d68a52f47d07507e94af3b8ac2d495b7a56aaed103965b4317941a14412db66ab3f5
-
Filesize
205KB
MD525a9dd26196c10d332a1441a4c535802
SHA1c189f91d8602375419f70ee2d22a046d99848d7a
SHA256afc036ab7a5cf5f62c920d7a89ea01ce137f2d225b8c2ba45cd0d8185a9ef7cc
SHA5124df1340f54f925a00c281add35853cf6b4189400b414a17a360c141b71a78f9df63442b474256d7f45d7b76dc09a7d091b1be28287613e6c4e6c9851accc01c4
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
552KB