Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 05:21
General
-
Target
861d03c7c919ee7e23450a8a915945f105d19ff1bc4d44e22244c81b03041c65.exe
-
Size
218KB
-
MD5
153a0b2fd92219b601b93323f6ff55cd
-
SHA1
4a0bea33bd52e2f626729940cdb978b48dd1d189
-
SHA256
861d03c7c919ee7e23450a8a915945f105d19ff1bc4d44e22244c81b03041c65
-
SHA512
bf02a4b3612ba2c97eccae0ad822ae8fa31b212a90b0075f71124c01924075082abf516dbad8d7442b8131ad003985667ec54c56c714ac4d5c0a0b027d895fb2
-
SSDEEP
3072:Dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:71SyAJp6rjn1gOObn4b6h9L
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\861d03c7c919ee7e23450a8a915945f105d19ff1bc4d44e22244c81b03041c65.exe"C:\Users\Admin\AppData\Local\Temp\861d03c7c919ee7e23450a8a915945f105d19ff1bc4d44e22244c81b03041c65.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD583f3631f2ae25de1f6c0e58c6c361020
SHA160b7d62dbcb7141b615f6dec88084bfb1413f763
SHA256ec661e1134551bf1ec798086347f251ff5e1ad529e66dd7bc5139a1ca4190be2
SHA512986cb7d2206a1aca4fc6ac71b9b9a2d495514d50ab5fd5515c9d09bff30f5c5d9351874bbf2346d4f2074d41a2350c5ccc4b7936ce5b97ddf2e17779a66ccea1
-
Filesize
1KB
MD5cd9f317e7eb9fad3bfe67d2343d36869
SHA15c3f91793930e2c558164dadcd91e6964163d076
SHA256d94455a2d8f76dac5eecfd1f5131fc0dd6da4f7db16beeeafe2fb8f72d58e0c0
SHA512ffa898c2a6b4eb8b8476b33b6cd891caeb6782f420f1774e08bd044278bc9d92ba1a4bdceabd07af657e78fa51e0322862047f644d51997a378d6d389cd603bb
-
Filesize
24KB
MD5b6684297220ebb96a008815fc09b5f5e
SHA1d2e928c2f60ca49110627f6034226969a6721c1f
SHA2566ff95164f977dc1f3b5536e91c967e4ad82943c200349bf71adaa8264fa2eabb
SHA5127b9a67341314c6e7abaf2193859171dd3b7559792ce7d278cf3a690ecd4e402f643b724dba17f8fa43025f2e7676d28a08cc0106a64bce4e86e70766b8855952
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5d3b26acf204714acfa889d7d9b88daaa
SHA151750c670b12c2b5c6432f1584d14796ec63c63e
SHA256adc97fef997cec71b4e99f9190743e55dd44aa945a99121022e5cc39042555e6
SHA512214d2501f236e87bb608ca76df3d88c29d89f0ddb663b5851eac22d5d2758cb960c2389f4c56cc588c4bdba2588e52ef1dbeeeb14d34425d1b538fb369c8d250
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB