Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
05-12-2024 02:15
General
-
Target
c987205ae8d0840afaccec9778186c7110d4e0421835c884cb2c26ae54703128.exe
-
Size
218KB
-
MD5
67271314a2fdf276a2cfb98a553f937d
-
SHA1
a71b0ce9e585a8b7ce3f041a8ab07726aff2fe90
-
SHA256
c987205ae8d0840afaccec9778186c7110d4e0421835c884cb2c26ae54703128
-
SHA512
e075717f528228755ef58eda14ba7dc4be29454c03812dc77871a7c6d414491b5cefefe3d78df18b0dbdf877690f572aa9c5db05da03d5f56916b597bcbb067b
-
SSDEEP
3072:zvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:r1SyAJp6rjn1gOObn4b6h97
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c987205ae8d0840afaccec9778186c7110d4e0421835c884cb2c26ae54703128.exe"C:\Users\Admin\AppData\Local\Temp\c987205ae8d0840afaccec9778186c7110d4e0421835c884cb2c26ae54703128.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD519bd561003d3ee0c4fe0c93e8039f537
SHA1a297b36482e5fc3d1b15549ff90c574f015d0458
SHA256c2d7a7865591a036b2eb40e2b9166a1a94872f4aa2203e0999e2e8ff0a5750b8
SHA51284ff4687184c2142a65eb369165d691df263f17f285bb9f810655b933c1c0fcdf52566c09d50ef7df9fdd9f6a5da92a4b9a93f38b0734355d9f01cdaeaaada9d
-
Filesize
1KB
MD5e8a3b6ea204d28b7afeae75515bf8974
SHA161c5e8697f662526f47bb977c1bf3956c3ba628e
SHA25669dabbe89d4bd6edf7986d936f4cb12072a0ceb58b177c462b65f4c03ea7f600
SHA5128bb47f8eea09372452d9ad273b907394ad9bbce2b077a347d480572eec303d6b8a39e6972156f7add95b4710e35f700dd1383dc4f8000549006958707dd284a9
-
Filesize
481B
MD5576d2a2824e2e5b307c5098b339b8d0e
SHA1f927b1c22861055f7984281e3bd792335fb87fae
SHA2565cffa4bbc9b99a3deac674777def69f053f62a218f22a0ca09e37120ade58697
SHA512dadde7b86c879acb3c5b5ab209abbc30aadcbddab8eecd41e37753f6b7b613eaf754933a6fd39f47717eb33cc5f594a1cef7000461a0fe8afe58a185c82a21ad
-
Filesize
218KB
MD532dfbef7f1042ba6172a24d19677b5ae
SHA1aa198efd40d46d0a6a18efdfe3416b6bb226fa09
SHA2564fa7b882260ee304c4b27a8248411c96446414e3dcce35d12d5675f04cfab253
SHA5122af31acee732e4c3629fec4edcb02fba4b44e6a65e5db796bbb076f1e7cf303f43b7b2b9f00122f5f0d5d6011453bb741663decfefc426a27ed02a73c5064c98
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB