Analysis
-
max time kernel
104s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-12-2024 17:28
General
-
Target
48b0ee4f75143145d87a81d8a0cd86a18d3d1fe30ebc181e1f7afb5de6d19fea.exe
-
Size
686KB
-
MD5
c15c845e61a005d50f7e68a18a315b8d
-
SHA1
31431dd7a84dff7f559530fc2d5c84c1200ba274
-
SHA256
48b0ee4f75143145d87a81d8a0cd86a18d3d1fe30ebc181e1f7afb5de6d19fea
-
SHA512
42c360a1984bb5599dab7b7307306949f4ee9b4980457c79d789b7a17ca8b3e4119443ef7ed44d1cfb1c2367dc75b64666903e9f9aa1cb01428cd3499a3c1216
-
SSDEEP
12288:GmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpl:GmUNJyJqb1FcMap2ATT5itjCYZ3DSol
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48b0ee4f75143145d87a81d8a0cd86a18d3d1fe30ebc181e1f7afb5de6d19fea.exe"C:\Users\Admin\AppData\Local\Temp\48b0ee4f75143145d87a81d8a0cd86a18d3d1fe30ebc181e1f7afb5de6d19fea.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5138e938ecc10ff8fa0f924f6e06cc619
SHA1a1ce8baf6ecdc2fcaf0f9a8b63ffce9c0f472e19
SHA2565e62630de7d7a721bf6b2244458cbd1bf74e3665a7f063433d51e85f6c9b3125
SHA512960579a3d6ee2d43ef70816c45cdba9d1734819b5fc21949f2edfc9d0bc3515c58b78de7366f479871ce6fac43d58a8f7ebb30fa69959aa494a4c1c0c7dc2ec7
-
Filesize
24KB
MD53561353460e9986ae498bf82b2fcc740
SHA103dd1c3989d9de2e2fce071d6941733d3e7915a6
SHA25688c26e220611ea351ba57721c259b84740e191ab760c82ee60a779ba8e054637
SHA51226754d71ce2cf71247dd0206d7410f9f6c3c77ce69be4517df38805460dac6abe4d061b4899b0f88eaf7d249e363b91977af28954dc8f837b72a83c7d3c8f5c4
-
Filesize
1KB
MD5ec9fab90563ab6b1d92999d771d7f4cd
SHA19cdc6d1614b5a0f7c0b01703e080024ef902f9c2
SHA256cc54f9f4693e43e5d8843fb6d723b78a32c11256868d40b527f7d7800f523a54
SHA512b3018801b04bb8e3e0d7f5cfd44559e87d34bf4096e41c1950f190d66f6af99b5035558255cde7c6f91c5048d78fc6fa1e3fd680048545095caa7ded4f911338
-
Filesize
686KB
MD54ef9750ee2a31f1adf069f9f705afb41
SHA14e1c71e328aa6b1adfe9dad8f2022479237056d0
SHA2561a52559e546d9a801cb7f64e63e417e2f0378e57593dd9878ffede41c4d97be1
SHA5127a9ba9696cac5fb75b77bc8605423fef198e565350083607187576345daca26b895848d42582dee4f3577423a4e793f31cc76da51a92d8236c3a8ff53d0f369a
-
Filesize
732KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB