Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04-12-2024 20:22
General
-
Target
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe
-
Size
217KB
-
MD5
b094ceff6d937a4283d50d0dc406d203
-
SHA1
f4edf55840be139785500f72f23310220d8ebf1d
-
SHA256
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936
-
SHA512
09e158b2939dbfdc6ef03c2d0612ac2a4ae9cdaa3c9171379b306a58fc6bf5388f1f9e888b7658a6bc2018aaa68000a9e851dbcc08b67c4283932331dc69c560
-
SSDEEP
6144:urRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:csTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5efb37741cb846c77dbc7a197aeccd314
SHA1ea3fd4eb17b27aef3c39a8ff37a6f2d15293fb8c
SHA256aa43414bf13ea388a06c18ef4f2d71aaefbdad41145648653ba4b43a5c945835
SHA5124f0c843fded2d0e674d0096070895ddacd684f2fef44b7df37275d159f5f6a26d21350ab999d533722704cf4cec580cc1760868888a4f4bb96393c761609c2d0
-
Filesize
42KB
MD53404065e08ad3226efb6fa08f0f3a3a2
SHA183cb763ac78e151822c19d11eb8a56c21a6bd359
SHA25691b4449d941f52338284a179fc69a78f2f0621f605297987993d63a0a75418b1
SHA512cac49cd3968c8c4e81cc4ff0f9e068ae3b001c7b06df5eb0902f2b9b257b28e12eecdcfa523bffbe4ced5921e54c293e274b9772dcb0851389ab12188098fd08
-
Filesize
481B
MD5e3d63763395f6887f5c3e1019f383dd1
SHA11188e4931a15c6006dc28f8f8f4264461c851406
SHA2562257e46c9ea53f3a34ae0ff8e54e6043adf61f28f3cd5bfa30400c934d6f6784
SHA512c6b29a9756fd167a57be69e4f1db9038ffa0d3ca385756ea611fbd5d9164ff7fd0fb7f429d50d57f76efa09f35a29491bb8ee5f37180f34e051c18d3c9cc365f
-
Filesize
217KB
MD5bd45794a2a393d62f5f10eccea82c620
SHA14b681bb51069414b57261b5afeb685d2161ff612
SHA25662f0e3c49ecc60df2836db396f41fa5c11304907acb36d2268020b2a24aa5b13
SHA512d69baaf8d54b79ed6a95303f6e21f5b9b86dd9fdfe4bda540a8796429c25c33f7f8d5d7fec17ceac5b529fcfb111db8570fbfb8eaca342bba306733b0a8afe5a
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB