Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02-12-2024 16:15
General
-
Target
6cf2cb5ae626c5b74cc80e82d008d2c17a4d9450bcb4d04ffdb9a7373504b9f3.exe
-
Size
375KB
-
MD5
86eb71611d7278e6257e8fb95d0f9107
-
SHA1
04ec9f19d586331a6bc6a2149464adc751153304
-
SHA256
6cf2cb5ae626c5b74cc80e82d008d2c17a4d9450bcb4d04ffdb9a7373504b9f3
-
SHA512
8c4d1f8c93f25db06f647e39caa4afe64f2fdf689374ed93235304a409c7f234c153f915d1ee22fb33c47e84f71c82b2c7b6cdd78784bb2a6c0c22c524eb0f95
-
SSDEEP
6144:Q3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:rmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cf2cb5ae626c5b74cc80e82d008d2c17a4d9450bcb4d04ffdb9a7373504b9f3.exe"C:\Users\Admin\AppData\Local\Temp\6cf2cb5ae626c5b74cc80e82d008d2c17a4d9450bcb4d04ffdb9a7373504b9f3.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5b77a45289b04b5b8d06055d474c281de
SHA195069bf4e41f47688b0f6a8ed3766e908ce66054
SHA2563b6a91b2ebf73dd02cd162ecc667122384368efb2aa4cfdab723dcfe66dae4be
SHA51261163d013407e823ab9875feeb953069275075d4c564a5351db2d16df4412615dd9183694c84689a1bec7e44af8c9806f787b9556d1bc93351ac21b7a4812bd2
-
Filesize
1KB
MD50930f67c82d8042733821b6978804caa
SHA1f4ced5cc675ce9ba14f89e593cf8aefa14e04179
SHA25686fad5ebe5abd56bede8dc6fda4948c03c822cd8a47458e2629e1d00f52c15f5
SHA51201c3e7ef8a4ecbe5db5b2f66d5ab9a64810fd0919e3f80f40538954eb1e8cdd9a26e4e53e81d46236c8bee1421050118e88570c5cb5dbbc106de84bc77879870
-
Filesize
375KB
MD54d4106a3beabcca8bc61bb4d56ddee2d
SHA107862301978aba6bc3f9efd0450b5fe18de70c38
SHA256009c6afe057391c4d3ab2251cf50954aaabc2b8d53ff99f29ba8fcff97ec4a59
SHA5125e620efa13d1fe4db01b0200cdc30b2ff0f2ad2d8549c9e27234c90f7368d95d12cfd561b5d0520def42e006ddbf9fa6513ee19e805c84b57329138a644e8ec3
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB