Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 18:51
General
-
Target
8fb87082a47f5cadb66756114cf8872cde93c83bca2b4ca9e95bd5694924418e.exe
-
Size
218KB
-
MD5
e62774c540db820bf8ccd9e3b8821547
-
SHA1
040693375c3110ce7ce7d46ec3171bfc67f700fa
-
SHA256
8fb87082a47f5cadb66756114cf8872cde93c83bca2b4ca9e95bd5694924418e
-
SHA512
f4f9c6d1f46c5f8be3666b6df878aa11a2dc38c2d469bf07ceab8ce04922edea00d16d7c65646f662365dc93d8e36a559d2fbd3026a8460f9abbec44c6d31ee2
-
SSDEEP
3072:3vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hq:/1SyAJp6rjn1gOObn4b6h9J
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb87082a47f5cadb66756114cf8872cde93c83bca2b4ca9e95bd5694924418e.exe"C:\Users\Admin\AppData\Local\Temp\8fb87082a47f5cadb66756114cf8872cde93c83bca2b4ca9e95bd5694924418e.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD598d561bd8f8e6febf6b947cf924d7624
SHA14e0432c5c855454effeef4df407e5fa0a2180f8e
SHA256fd2f98495c643c43790420f98de0b8e5f9ad473441733204ff2ceb67e41e8b86
SHA5125763c9d40ff681ec70af44d162351247e1cb2d7d11e547da405d60ecaedc39b5b8b5a835eb750980de00a77ec2d7858cbd35dfdbd15a084da8fef43ebe263ae3
-
Filesize
24KB
MD550f9c73fb8507328c633c0b3571b7d57
SHA126d03b300fcc0a5b2336a29bb533c8b895ad15e9
SHA256e5d9cfacc8f94f0ff9b3731335037156af8d0b0b279e6403f695f1a63b1c68aa
SHA5125132d786a6ca6adae70eb630a0e57c6b919967fa8537c4cbbfb97067cd7b735179b98c4b1c1993ac8d02b5acf3a1aed29ac5fd9ea107fe2cc3b0f8998d5d6e23
-
Filesize
481B
MD5539b700efc285c349c1474e40cc4a5b8
SHA11b4b5c62890528ea4eb507895587e8ed6c153f65
SHA2564069f7ac6b1d42215713a9890a9bc2d88ff55b33c102526596d560c234ccc783
SHA51283e329679e3d77ed9e70f5194ad7e223d023847e698a37a5c4ac59d6a789de7ea1f6901b09897c18d3be5de320e47bbdd6de454c6a611bba68405b9379be3041
-
Filesize
218KB
MD5af882f1d57113fb9f0f4825d2815c15c
SHA1d3eb7490b9470be7b54c72b6bf873c4387176c20
SHA2568a69250dceefe7b9833fd70034988cd34c24f6081085d2ee4504b1626cdd8a7e
SHA512377bc47624b01f1d0d03909309ee07c44c35bf4e8aee47f74381fa359dfdece62cf89709aa64ec919d8b3b23b518a218af28494339bead61adf47d4142ecc66c
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB