Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
06-12-2024 08:27
General
-
Target
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe
-
Size
355KB
-
MD5
d5ad61b8ab1703ab66bb8452c961739f
-
SHA1
c8e516fcce38bd7390ab9c4b8c424c9a6ce99321
-
SHA256
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5
-
SHA512
aca99fe4de04220de4495921608d5e2832060175c7c17c688e4f93f8f1f4e07dd9b7564545d2a195a9650b3db774de4a624e6c6ea0fac8ecb9b069f601c59286
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:3mWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f7bd31ec78fada2e58f010fd3a658205
SHA125dd25a5c0371a6b8651a7b537ed06abf9ab04e9
SHA2561ff20d0d88ca1f284d06f64d1cb40ab646677f19a3f04d92acfa9329452a35b4
SHA512f448c6c1188775041603f737654e95551db815bb10c8a5381ff43da910f65103143323e8c66f800123cda00c436b6a43cc99c37c55c48d22f94ccf8070f8e78a
-
Filesize
1KB
MD5cf768cb1cea40eb76899754ef17bdeef
SHA1a52a8e3e73b380a973b9b5fc8c526fd11764fa98
SHA256c6e06f8a7ef2ed629c65de5270dc99a4614984d0a6eb2dc2f516135d056ae308
SHA51249f04051963aadeea46d84142f89d7379badce5670153b66418a3ca8b900ef3db2fa6b3eccde8223c160f6895c3b76029b385032d7d0f55dc1ff9f7d54407a3c
-
Filesize
355KB
MD53da31a941770ca69a7b2143948a6467b
SHA1ba1b7f001dc81fea2651e3ef1154c4c517da049c
SHA2563faa1b734ae57b50456700d0d1bedeebe0023b10f77e5662205d75cf8b97970e
SHA512ff9f325d96e179521329debac3733187e105ae9af3709bdad03e985dfd33fd11a1a8a92627b5943d2fd6b667fe2838c0266545bf3be9d1037117ad1a527d1e16
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB