Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 19:14
General
-
Target
8ad57523fde2dd1e788f4b9770e3c7b178ff712d8857c58f0330d492632489eaN.exe
-
Size
218KB
-
MD5
ebf3b689f2a326714dab5757d1d0ea50
-
SHA1
6697051f209cbe0c901a5e2b378412da7314a85b
-
SHA256
8ad57523fde2dd1e788f4b9770e3c7b178ff712d8857c58f0330d492632489ea
-
SHA512
a0262fc3c16d304c8c402b705b9aba20e5218b88715237e369eae8d2d784692a64b803eba68e219035f29ba11f7267b79ae67109983f689ca33e5a6caa4ce502
-
SSDEEP
3072:tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:h1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad57523fde2dd1e788f4b9770e3c7b178ff712d8857c58f0330d492632489eaN.exe"C:\Users\Admin\AppData\Local\Temp\8ad57523fde2dd1e788f4b9770e3c7b178ff712d8857c58f0330d492632489eaN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD51721869fb3977d0bd84cee646c09123b
SHA18d53cdc9ca48a3b7b99f5982ecd4f9e1d3e65347
SHA256c043f298369789de807bb114d676aa68c2718294025cd232f36afb0ae6fdf59f
SHA51222f5b72a5602b3643838d1c1c7793c04641d03555217a64a071c0b719c7e2c8f644e50b330ba031d8c282ff998a1c4afe50ba287be257e44a1513f5a69e5035f
-
Filesize
1KB
MD508e683b58945ac45d8e82836b08a9016
SHA12d08ba939fe01b732506a1739cb4c14294f9e991
SHA256d8fa7b9deb1595e5027a067474e96adf813cd98681a783c5cbda9f0f57f5b505
SHA5123633d84c7d7fd3a57a7df3933a45b8115d8627ef8f163ef41148afdb2e6dcf2769ba947ccef87fbb695b867f566d4a180b7ef96555e555dbf67a8f713717b38c
-
Filesize
1KB
MD5b12718c2c0ed67b8368fafaafffaacb5
SHA1d2b4e9c855298b4e9063fb42d83d936b5ff2f741
SHA2566ebfd5e84ec4e9c1fafbef0d41e507bde2e2c9a71682fbbf68a8979213b1ca97
SHA5121f7f0f3524c5ac126c0fc8458892259b9142194a3154381cfb9787a8788a811590b9f17c446462aa5a5b1d58ceed2db5a5871bc0bb7f12ed4f0bd343a2241921
-
Filesize
1KB
MD5d976f57772f285f04fa947962d8ea159
SHA14cd9fb95fe5468315785dd439afe7741c02b3819
SHA25683954bd48e6a94d1861992caf3bc96da539c70cf2ba82586712515cf2b806019
SHA5129b5ef38c94e35808f2fa2c824edd49430a38584de762c7b2bc27873fbf6a368f9f215edf1c94924d4edc46caed8c1885de5a4d634dcc75fad05ae592486b13a4
-
Filesize
41KB
MD5fff42d24009760c7a49ab1287731febf
SHA1aef1ae69054885ecc2e39af7101584119fcea3dc
SHA256ff482a8d51560d688cb370a9356b0cb7d8ec2cd6cabf7ff126cde09fce9d5af2
SHA51244f2b6a55d31fa46c717ce7491f24dec5502ab969922acd342cb1446f4d8638bcdbbd4b82c5b888166225e0f5fce4b2be1642faf8e65c2a4c98903b254e70b99
-
Filesize
481B
MD554dc7ad52ae8fd4bb1816f9bfac489c4
SHA1c9db73c20507fc9c734655559eff264c9bc59db2
SHA2565b2ee8d31b9575af53acb5e8978b3df68314a32db54076c76afa0ea0956a81a3
SHA512a630825bee777e54ee057a8bff8c9f29fe273dcb4137ad4e7e46597b53ea20d95690912fbbb25564799b427be0ba3ddbd572b80d279b4f623ffd78c395094d91
-
Filesize
218KB
MD54ae5d8d558ddaa4c863f07b7606e107b
SHA1f688b20a9255683e1b6792b00a94de331343e828
SHA256cf6e50ebb66cf55e662883df1b9ef18af425094cb73a863b946f4454b7c43126
SHA512bed2c0c33b83377544b9fa5289c3e43ec2c29e97ae333edc676f0154d69510908df365797477ea76cd3e6ef75bf528c4f337d9f924246837553a71b74f77d89c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB