Analysis
-
max time kernel
110s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
04-12-2024 00:56
General
-
Target
9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe
-
Size
208KB
-
MD5
37293c23e4d2fb6cda8165c77606b158
-
SHA1
e21c2891ef9b4dee74e6014756030cee0c2ba2b8
-
SHA256
9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373
-
SHA512
633e5b5aa6607f5b6990d3e0bb5f126300356dc9150647078081893b84b522da0941c6721332a5e213950552d78d1f2b1d375d0f7f84defd3cf832fb61adaa2f
-
SSDEEP
6144:Ja1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:JbapK0JCmRcU9vVokf7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe"C:\Users\Admin\AppData\Local\Temp\9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c5ea33615366da15c6702ba0d6be6505
SHA1a2e9f9d2f7939de0625ed9acd78cc1d4e18993b4
SHA256038c730a2cd213aaad93c15a4dad27e09b0165b3532a39314f131f37d7e87097
SHA512eaaa45447a302d2a2a71974bf371304336e70c5492aa7fcb31ccf68a3deaae29efb9c704654057cd5d31b2bb0f29ef1ed14f23880c8e41d1636b00ec68239890
-
Filesize
481B
MD5441c96f4b879d3f8a3da3449fd119a1e
SHA1d367253ed466a24a5047d490bdadd32f4240920d
SHA2564f8d34721dc1542668de2de5de2d0345fbb50eaf38c1b26358ad952cb4182ff1
SHA512c26bcb6a342051e639b9b769cef02bb0a2f57497850e8e253911f69ee8645b369e237e6fb354e035896daf2c14ce44b631fa61f3a2b0bfdc31bd372981b68f9d
-
Filesize
208KB
MD561386ba3b1ccb470b06b9d6e3273463a
SHA1f3014606092398949e70dbba16231f21f4132ba9
SHA256cf18c350e33925cf68feb8598813a90cda51bb6f699e18dbd9252bb67d951edb
SHA512f7eff977ab75f596eeba756ded4df4d2cd7fbc3e14ebb599b3d927738021dc61fd830ec6c6d4f9c6b9f8c1a4027ea80cfb6796478a01a779715a3de9d158f029
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB