Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-12-2024 08:47
General
-
Target
f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe
-
Size
218KB
-
MD5
ef8e448d10ad0bd7e148f0115a192aa8
-
SHA1
5a37375b6d4ee5c2d946baa110e295efa47667ec
-
SHA256
f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9
-
SHA512
7ab4f989037ee91a38be501ec307f4ef13a2b756a756bd1ded92bdd364cf825c2025e47022ab78f05145cd0ee67de38c77c81cb1d541e4f0467fecce9ae145c0
-
SSDEEP
3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe"C:\Users\Admin\AppData\Local\Temp\f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ecfeb9196fe0563dfdee0dfd8cf3e7d1
SHA182d56730e4d3b6d5c8e294999b83fe183cf1ef6e
SHA2568664ceede20932cd9edfc717ac9a6f4429d9e5c4926d56539f51ec19c16f3fd3
SHA51271b35f6cdeaa753ceec98431c083b9f36314e72e899b92922d515d123a2e3efce3a82b0236f3a44cc6439f79ac61396a394f8ac394f3057785e85850fe80daab
-
Filesize
218KB
MD551096fffc8fe8263318629543fb0305c
SHA130ca7ba07fb7885a8e11306591ef08cd5278d451
SHA256bd23e68291568c856c36d648a904ae4a959b3d1b766ecb33db197c41a1e6367b
SHA512dfd4310409e3dfc0b604c27157ef27b59e8e5daa51b4bd48aa84d670bf482aa7fe1ba43f8c09be5d4545feafab3365643e62bbfe729395aeeaf6e96005701cfb
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB