Analysis
-
max time kernel
132s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
02-12-2024 01:30
General
-
Target
b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe
-
Size
399KB
-
MD5
c5c31a95f5c95b7c9f564e484801b39a
-
SHA1
180ef2dab173973a523eaf0df3d5d7705fd6ed7f
-
SHA256
b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a
-
SHA512
8c1603ff51493032201b7419edf3320b8a3693ee0346d74faa52d87c40c37bfbebff541bb73dae578e9e9daf90a191197760039c929684b27f2f6c7cdfedc43a
-
SSDEEP
6144:Y4EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eir4Xd5Md:qmWhND9yJz+b1FcMLmp2ATTSsdr4NW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe"C:\Users\Admin\AppData\Local\Temp\b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5f0a5e93405b331d45b3ec8ac0bd3277c
SHA196d8a6bfbf4e3814b51ebb2941449d15354d0688
SHA256d764cd6554acfdcd0bbb02b5557bf7def75bafb7d47eb3a607591f0fcac958ac
SHA512fe91d87adf98d65186b9757d55d364c278130b54c95144d36423566c7eabe84d204138b7f2af28de97d8c7b28e440fa62f71e8502fba420ef39f66f706f6f533
-
Filesize
99KB
MD5cffc9bbce7daeab86ab3a2327bf9a52d
SHA13a3cd647173aac5afd073b7791b52aa33bf2927d
SHA25653dda6b4369471a2e68746df195b10aa763580678b8c9c0d48d955d172ec1efe
SHA5129c988631e56941ff4d0d76cebadbffcd818c6c50496de68a1a2ab28b18b3f37e3ed1dff79c02b331e1e449852f252c677ecfd86d07697faa9ad7208c69494a22
-
Filesize
99KB
MD511b4f56ded2d3e80927993ed69b1aa71
SHA1149ed8f14d376bdd4d506207f0a8bd7e91b2b076
SHA2561cd5960e5a8376a2526907eec962131d93021940ee24b8ec08ce313cc8b0f4dc
SHA51288406cdb0816862c8adc278ba7f328ad1cbfae6f6abeb53ee4669f1143f866341d7497815e93f952cca3f075151834ee9a2d5c6d60d97b027df2dc4ded09803d
-
Filesize
481B
MD5ef9717958760393b753cc555eea40cec
SHA13ebc573a5eb474aa843cc48e524d044a82d07b86
SHA2565ea46c01eef21261c9567e86f6681c2e789e579875a4cc1e7b973337dd53625e
SHA512aa4d291041d33af1566647e3256dfefeb4f0a0e7fd467d3855706d993037916c6cf73e63b5bb70e633d5363d24d74134a4f704372040c78113957c9f467c5ed2
-
Filesize
399KB
MD5092d0aa721c79be2893edef95c59c547
SHA161300426367ef79a3e1330cad9f9efed17502588
SHA256c08aa46a7b43cf989dde53df5dad0e90f8120715aa4d72f1467793385bc35624
SHA512c290c3172b74a7be67a9bd5b2d776e9ea44d121fae60997075bd2fd0b4ded1f609aa5cad870a7c2f49019714d161172c1ff0f543535d57cfb09805f1be4a7858
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
424KB