Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-12-2024 03:15
General
-
Target
6688cde6cdb341d0dbe0315f9110825843bfbfe8680f4524ee60002be3374c6d.exe
-
Size
218KB
-
MD5
a3ed03d40d9dfaa61978f82d546d11d9
-
SHA1
9f59c1465fc40447bf0ea50c3f595e1b3b0f325c
-
SHA256
6688cde6cdb341d0dbe0315f9110825843bfbfe8680f4524ee60002be3374c6d
-
SHA512
beb5c9a9dd8b23ccc338da7fc21cb6f0351e71669bbe679487e5ef154da5e55cd43355c2e602a84c62a40954237e5a6fcc74bcfbd62d685cea33ed478da571c3
-
SSDEEP
6144:GEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICS:GEGDdQNHEwWlMxYG/wIj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6688cde6cdb341d0dbe0315f9110825843bfbfe8680f4524ee60002be3374c6d.exe"C:\Users\Admin\AppData\Local\Temp\6688cde6cdb341d0dbe0315f9110825843bfbfe8680f4524ee60002be3374c6d.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5c1cd6bd05004574f5303a8416eda539c
SHA112a5fd39856aae9469ee2ab1486ad50ef58e655c
SHA2568b37a6b67d702701d70ce12da4160caa96c2858e91a644703e1c7789ba3190ea
SHA512b3bedfbef5274bc72de7c10647077456f78172055cca02ef1fed1227588b65ac7749ec62ac66c0a43c8170d2009a151da1b37f82aca4a42f8a3ef9b7e3423d4b
-
Filesize
1KB
MD5d8343bd59f11a7d27dc492aa5fd0408f
SHA16e6bd72c375648400156bf381258c497cfd74885
SHA256624bf628a74e114f4a8a1220417ffd3ab4528713efe57bdc1d46c2b689e0a734
SHA512340e6bf032f9820b4e5c07904c16892647d9d015e9da39c7b44de7ced18f021f63fab241f297510628f43151947795db9a40397d0bbd1bda4ae47a43463218d1
-
Filesize
24KB
MD55936b597c3835b4d953115d2cc65b420
SHA1b724f887ba92c065a64c08e8d193ecc90643f466
SHA256490f5051223a33b5232d75b6e92abffdbfcf840da714f485be2ba725d4217674
SHA5121854ce3b84f2c5902f84725723d82c4da4a9c89e2ab34a2be1e1e945080ad0da01f110d278f994a0437ebfcae5148f7ddb46d32fc93a6fd7215eb80d67cd81be
-
Filesize
1KB
MD5b999da58a5ab405fed8c3c0b061cadbc
SHA1b1a1c58b22263cc4a442ef65cb4e9ac397a173e5
SHA2565f9fea9d61ad84f9ca6837d52c7cfd7e72e33a5f4828cbb0ba1164f9fa57c869
SHA5128da031a07bfc35c769cf3bcc98f832caa0bc9efd9183e330c05e41d140b4aea4535fab2008587fa65341eb3ac0cfa7a126255b5746f32d2db44c80675ae3675d
-
Filesize
218KB
MD564ccf09b473854a62903415746dff0af
SHA139290058bddabbbe64b7349a37d011a2501649ce
SHA25652a6e916b41b50590f715f6ce38e7392058f60f28d3b913065fa631782eeb060
SHA5125e7fdf5f7786c4743499ab2db3751e81f067ffa548f7115f954f0c4fe16917d7a87ae5276f1d904c3b5c461d524ad981437ab0bb06d3d8c6a9b8941eca69910d
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB