Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 00:18
General
-
Target
080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe
-
Size
355KB
-
MD5
29b51ae571e83e77c4f9b238092383bd
-
SHA1
035018aacf89f106cf16b874d979c3756526a1f7
-
SHA256
080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496
-
SHA512
3bb28ea98b382a3f2f24ad98df588eacd069364ec6d0a37a97a464c306c6a5ae3888042f98b7d32080cf009a912bc0b42120211d96de0c8dbf1beb4c9b5fe124
-
SSDEEP
6144:egEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei1:ImWhND9yJz+b1FcMLmp2ATTSsd1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe"C:\Users\Admin\AppData\Local\Temp\080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5688da8b6ef24e4d3aedeb70d8bf047ba
SHA18f6603f14551c150b9c43eda489072119f1aa114
SHA256af6c962e2d8ac8ced7a58ff1204c8610bcda6ac62d37ce30b5d0417eadc05098
SHA51246af1b4a83203a00f5adaf3c11d2df81062b5bf143d0961db480ea1337934d1469ff161590eedb4df179d9e4ce603dff14f184ec54d18483928a55f07784e0d0
-
Filesize
481B
MD502a4ad6ef194c1c95cb74c36e3b08ee6
SHA1e2e4aa3a9c1cc46f2a23fcb2ccc72eaf5f5da280
SHA25669b0be122b5f72c623a0ca2ac1de3d8255deedf376683b7185bf1e9e461c5f57
SHA5122b5f5c2e2beb95c6e4556fe449b7ac62bb78d649e16c514811d5a250bfbbce30494926ec5f414d886316c5b3bac52755b40ce5a48b6dd86dd7b89b82555f0208
-
Filesize
355KB
MD592754736718f42d6f882d156630d4da4
SHA1cd6b465cef9a50714778160c708db142560841f9
SHA2564174f86b52af2baa5b4e22aca63761735cf8063df9f8ca3be3638e6ea3a079dc
SHA5129a7b839c948551df95bed5a52e727f4473842ad2a2184553adf65e6017396da3fe3165d4ef09e70da2361c60cc7a88c6536eaa3d3494b274b56a253f28fb2036
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB