Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 03:23
General
-
Target
6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe
-
Size
375KB
-
MD5
3c508e8972aea1d101e00000ae16677e
-
SHA1
a4715f231f3084c93989fc761f7f767550a38949
-
SHA256
6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b
-
SHA512
639865195ad7ffcf49c49c321180ab329dba03b70997548c733c071aaf0573c73aa03d50db853dafe7a26fff3a523506566a0d933c90fc98f800a470cf5c19e8
-
SSDEEP
6144:j3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eis:wmWhND9yJz+b1FcMLmp2ATTSsds
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe"C:\Users\Admin\AppData\Local\Temp\6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD53fce8bbac0787571f4dcdf704fe1b068
SHA1ccd49c284534423a0079e47dcc25f4c3352e4d32
SHA2565954991177c2c09281716d212274f702bea25cf2ec692ac869d248ce77958830
SHA5120af1437993a2af45f5950ddb7de5b1cd9b50966ac964b0d75350a73419ce1559cbf57cc6d604b539402ed78a6ede7cd116076457c836de7bbda06e0021f74438
-
Filesize
375KB
MD5b9144f629d71d3da7a449778bf1f54e8
SHA1e40bed19b2605c826fbc9d2d8bf00600e31a19bd
SHA256c933f96111b92f844973c5057bd1d51cc3fac53fa47342747fa879b1011872ea
SHA51222f54fdfb7d0eeb0cb7b66826334fdbe1a70b77f861f5788d597a342e1372187b70e1825b13ae8346d1d7eeedb0e2ed782a240ec8bcefe263057859b1e7348a6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB