Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-12-2024 07:39
General
-
Target
fe9c78e65cecda53bc2c770681df2f2357f2304660385fcff24b73136188cbff.exe
-
Size
218KB
-
MD5
5e4d0db17a1b180c1270e6669cec9baa
-
SHA1
9a6df4bb09bbc8eb211704175c90f91cf0d40051
-
SHA256
fe9c78e65cecda53bc2c770681df2f2357f2304660385fcff24b73136188cbff
-
SHA512
6cf2136bfafa28da50da83892e6cc81002565b8d289ab73af578993f4a668629f52b7a4b17d64ff390143fa9d81fd1ddabd1a94074ab11bda8a39a10484c4920
-
SSDEEP
6144:mEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICW:mEGDdQNHEwWlMxYG/wIR
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9c78e65cecda53bc2c770681df2f2357f2304660385fcff24b73136188cbff.exe"C:\Users\Admin\AppData\Local\Temp\fe9c78e65cecda53bc2c770681df2f2357f2304660385fcff24b73136188cbff.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD558fb7b31e3ac0dd32838358524a96193
SHA140fc9277012eea548b061cd6dfdadc06ec9f8305
SHA256a54b9ff8995e2dd2205bf7274bada49861a18c997d4a333f318906b06b6e18e8
SHA512be638de9a688b563d2db6d206fe79787de739881e1085b39aa3102473d187a8722fbf0d3cb7ba427d2e5287fd1e9890fc247073fda29da125cd5150de5ef08c9
-
Filesize
42KB
MD50351da9c4f712cad0723ca43426c84a7
SHA1bec13045e2e8931b9763aa76b026c8982e9eaa35
SHA256f1d33ba287f8a3ed206aaea784d8e016f2a606f4e28ba5dad60e36d6ab437551
SHA512e6ce92a33dbce545ef69e4825e78f2a0bc8618744f1d23860ffc5033edf8406dc5c7f90e50500a636ea2c1135a1c413969e73f653b3340c75400f137b2186632
-
Filesize
218KB
MD5116dbcd2ea51bb61358c070e5ecec9ea
SHA1aeac01968041a8c806022a227b13de18e94d1e04
SHA256d9e427997d57caf77497a2f35e04e042bc78d6cdae84483ea1490469bc6f5835
SHA512d058c9f78bcce6ce046efd12ddde326bd22bc9e2efaab2cf6ad9cc32774120aa3e3ce3b41db27d29d2bf2f3a0be9cc06d2a3969860b639aeadaa39da1c513ea7
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB