Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 12:00
General
-
Target
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe
-
Size
218KB
-
MD5
08a1a3882d1d36c728c9f0f9c9e72e5e
-
SHA1
32cfd24da914b975803e986b28797b43ff17e156
-
SHA256
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8
-
SHA512
f005290d3e5c554b94f037dad37a5c75e7b793abbbadfd785128eae266a704bccbc78bf235ddaa388df58bf224e83e8275cf550e072f0724216d81b45e524135
-
SSDEEP
3072:pvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2He:91SyAJp6rjn1gOObn4b6h9j
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5d21bb34c2455030ad887f4febd1d4b
SHA1a381b79a86dd5af9788658bc73c9eedc877829b5
SHA256ccd4221c927d40b659fdcb885de5b44d83626dabda9e57360f8ea1b4376f23a8
SHA512cca566bce9262c1d2bdc81bcb5998af65481486cc51ea6f1f8d3d42b419d4d5d89f5cb3038167b2f6c58ac8ac3b523fb8f3920db4fdcc7785938fb82730e8506
-
Filesize
1KB
MD575fdc99d740f44b7365fd45ec4689b73
SHA125d357231a6ad660ed417cd7d02ea99690069ab7
SHA256f513965e65f2920e3d0d34308b73b82dd6f5387761b735a70690c0d0a575983d
SHA51238b9634cda845a3f71e715acb24fa2ff2be9b2d578479845bf583585cc65ba429cb621c32877cdc5fe73c5821bef3744bb10837b04ee7ded96cc393849fcb0bd
-
Filesize
42KB
MD56d425cbbc8b6b80478f30875e8a3b614
SHA197ef59b8b2a59207aeccf91c03a6005fd37d7942
SHA256da579a2b826e90fc99ab67ec9105eab7ac1b2ee75a4b69a42185cc88b9c064c9
SHA512d1dd664b24049ff4d8fd6978939813f9007507808d93b5ed9657c347da07a70bc1da6facc52b93289e1f66a99f04a4b6d08b1e5c1fbd578f3454aa67ac439310
-
Filesize
1KB
MD51b6a26fce95142a00cf3c3753ddc4996
SHA1ee544961d41519cf69de30270d4be224fad1d233
SHA256aeeb506f006953cff9e89315fdb442deec93bf65a7f5da7b01bd227d4b4913cf
SHA5122e12a05a2a4625ab901f565adb2fc1f88f3ac20a196c78663d749c750f2f43ed65a01be1afddd3f44af4b76e7d16604cd9ab3914ee4e3cc8e4173aa9fe77b447
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5138e938ecc10ff8fa0f924f6e06cc619
SHA1a1ce8baf6ecdc2fcaf0f9a8b63ffce9c0f472e19
SHA2565e62630de7d7a721bf6b2244458cbd1bf74e3665a7f063433d51e85f6c9b3125
SHA512960579a3d6ee2d43ef70816c45cdba9d1734819b5fc21949f2edfc9d0bc3515c58b78de7366f479871ce6fac43d58a8f7ebb30fa69959aa494a4c1c0c7dc2ec7
-
Filesize
218KB
MD5e2f6e681f8f257922569d497b6c4a6a9
SHA157638bc3a5055bc6545eb4e8952c43d1ce2d1e4a
SHA256b4ecfa933cb74cc3f5c0db8464d9edc935d213eec18aedc602a16a3509458627
SHA512d2e6e3197301c598e0b4850c2305a3fc1fb9acb809e46ae61b827f1671bbd2a2d83b600213a39af18e059f32d6f765f70accd1258aa599fa5ace09abeb13c9b0
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB