Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
03-12-2024 11:52
General
-
Target
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe
-
Size
218KB
-
MD5
08a1a3882d1d36c728c9f0f9c9e72e5e
-
SHA1
32cfd24da914b975803e986b28797b43ff17e156
-
SHA256
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8
-
SHA512
f005290d3e5c554b94f037dad37a5c75e7b793abbbadfd785128eae266a704bccbc78bf235ddaa388df58bf224e83e8275cf550e072f0724216d81b45e524135
-
SSDEEP
3072:pvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2He:91SyAJp6rjn1gOObn4b6h9j
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD510e656803d9f57cb50649a1c1c09a842
SHA1771984df63fd5df08a4fe8ec743d39ff5ca60b04
SHA256d584416c6757625c9d7d56daf08337482b5a9a7b412be80fdef5af88c5547484
SHA51247ee6f19fe2a6689b8bcdc1f432116c100ce7dd463697d968ade5eae76c2791837af6fba84b574a9257fb8364ffff3999c7992ffba465842b2638633c30065a6
-
Filesize
42KB
MD58ddd651223412cf28d8a2a200338950b
SHA1435cef3614bc7b0b99e7f2b8e54739b0566029a6
SHA2564518a6508795fc3dc1c323592429123f2721a8eed3ef130f3af3301b06762acf
SHA512ced4dcf4fa0c164f6d4abce52029f70c74752d089bda76171638f4657e44b67750c3031448b9559d855d2423c85b9ce292de423e7bab33184479aa78178e00ef
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5c7a6b962c5944e6f4e6c0ea8e25d6cbc
SHA1a471c1645938e3e1d966cd86024e6ce685b989ed
SHA256953f24df5e693d58d9cf8dea1b91dfd544f588cae23d2a2964a19386874b29e7
SHA51257ab949cb0444d6b3428918ead08ab636897a548066d3a1b1355c81e8ee2dd9cdc5589fb5f0950185fbedfe0ad2e0dd8421fac39b46a1a26e7487ad6daab0a63
-
Filesize
1KB
MD55ec9d486efc22e29ca4c35f34efd63ff
SHA16ebf40392a431ab705aab634cc3742d6b6f311cc
SHA25622626ef4dcc731994efda32dd024db94d367b665eac9e3505cf8b67b1ef02304
SHA5124208ceb9d6569a35bdec906daf8acc3ae973bf8942272ca1754debbcbc5de5aacbca0fab4216c311669c09bc0ae67fe1f5db82a9599f0fd2f44eb1869258aea1
-
Filesize
218KB
MD5d3123a205990d0f9380e042bd14f7c31
SHA1b7cfc49c18bcf3276bef133c7df536ea99087faf
SHA2564d25432b4d56e2897369e9a0bd9ca67644462c693dc654969df0c8da5764e37e
SHA512d3b5dfef0ee13f7fec076b5d3f42f078b1ce22d53beec9c9f9643f46cae0daef1275ecd3ef6a66ef222d0823586234a66a4d1059a9190f8daf1855896b608272
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB