Analysis
-
max time kernel
116s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-12-2024 17:01
General
-
Target
11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe
-
Size
375KB
-
MD5
2a73ab8b9b81946bd36370152f653134
-
SHA1
8c81339576944d187f02ab8e12b9b0b9b58c61e0
-
SHA256
11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc
-
SHA512
4cbdad972cf57edf83b9e566ed02bb0549e32a5f1060e918232ab6e88f24f69a3d026e983b956c36b3bad9935c4af8e6d7b9b0603a32a33448629e3e6da94f61
-
SSDEEP
6144:i3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:dmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe"C:\Users\Admin\AppData\Local\Temp\11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD59ed45cada706d10c662edfdfb5ea1d13
SHA1db0c151306c0c42c3a6768e66d746be505ef200e
SHA25660354ee39aab32bdbe59cb38141e29c15da494f4314a8cd0e79f7a0a57d531f4
SHA51292f29a7c9cc8a59ae8aea464129be711d3fd3050a1e02df52d6c946e2a62d9a265bca930ae4aaf93bff81b0261179ff5f9dc91dd5eaea4b001701f02e40d15c0
-
Filesize
1KB
MD59d979884314e27e5479477c9d0d4cfa4
SHA13c1652ed955f4acc67b3de85251e8ad24dd520cc
SHA2560df7f2eaf23e0dd0af99d00aeb3ac36f5d1693c9117fd28c06685055f36301ba
SHA5127c7c11144284bc46109c1e6d42f1f140749a53c919be12674226f81d96c4e12af6cdd25fce3298717311224108fcf23a8e39a615c988d0dfcbc37b6dfd173006
-
Filesize
42KB
MD5e9025d714b392760881d0af558d3c9ef
SHA1a3436b46135bdb175d858b9cdf9ec8aa26d49d32
SHA25620763388e4c7b487506492107f67a8e87899b60c8f63e9e28d8f506769d53e8a
SHA512c0a88582714a63d65a9af87b22214d0f1c54a11c161262c4c2c28d97eb160d070d1c7a952349be373e2354f531e0993578ea4adf709bd2216022a124ddcd4369
-
Filesize
1KB
MD57292bdcdeef2c8eece861b1e351703e8
SHA1db9de461ed4b490c4c17438c1cefb2067b255e80
SHA25684608ade28b49c05da0f496c223c3f2e05b58df3ac1f9e2f8e74cc25a0de987c
SHA51265e8b4dcff4052a90c08e18c7dd3941505b8641256d96d79546df988734f5f989851ac5199924e76bb2fea2de33f4b4c2a7d267beb70b7b5592c835787ebe54b
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD5b009f3c8ba47b6e5a25cd95fa1280ec2
SHA1390abc3fb347d89db533a6583d83805e5db50844
SHA25612fc794dcd72c60beaddf38d39ee262ce5d4b8505f80f1859d79d5925322be7d
SHA51225c5576f75fe439ce7385926ea945a09bc4448fd17b0e028e1fb5cee88957355ec0375cd9f7bba7ed539123b684ad7b2e939e41d2ec57cf0dde353e7085b63f6
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB