Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
06-12-2024 11:02
General
-
Target
e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe
-
Size
212KB
-
MD5
306ac6417922cc5b932d5401eb00159f
-
SHA1
0a77c250568174c170d783e5147dc506d32081d0
-
SHA256
e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109
-
SHA512
5938a4574d4f477ca9279408d676fc6588a6ed4735d8cc159db7cefadfb67a981899c9b741f87f68180a86626303e63941c8c581159f0dae54740d69c0ae70ff
-
SSDEEP
3072:aGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:aG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe"C:\Users\Admin\AppData\Local\Temp\e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD569fd144e499ed0f2c3227fee00398531
SHA186a32cd81c67d4d9951fb51132bc1497fa7c52b0
SHA256ea2a0f08e50e60dc2285df82c5fcb63553001a96c8226d63f1e2645e0d27c591
SHA512bdad82588ec3f74168ef99ba698e062a0c26b2e9642cc07673cfec1575f18d6138a6fab28be0bf8c1fce2be19f0b8625d513c8a6fb12ed1691318bda6fd77293
-
Filesize
42KB
MD52c9f1ffe7e20e9e4d75079dfcc09caa6
SHA1048dc09aaf0bab21d186ab9b76da1243be21e100
SHA256e90cb7a156748731a6b0df41ac50e3e634618f52cf6c2c70aba73eb0a005869d
SHA512c45ad7331c515e53800fdbcdb3221080156836ce6b5738c5e1f4f1d8fe5d1d3d8ff067597492391790d0b97e11b7d5ebac62e4467fc63a31651a6a4aaf6a030d
-
Filesize
42KB
MD56f12d1685bc6c4236e208029d215a422
SHA1f1310e19eea175796d65ccb6e0d5e22493c3190f
SHA2569c9049e615cd2fb5d65c771b6b98d9c661ad7695af19a68b3e702108e495f9c3
SHA5123ebc91eb5c88cb72384e32681ea5cbc406b5616d3743605fbd297ddf76be89145b9ee8487a884b74b4c7ffaf28e2e5b57ee96731ad1c76882249db0d5cc80de2
-
Filesize
24KB
MD5358e43bcdaa311a2871d98d7c0d84df3
SHA127d84bfdee847eaff59ebdf32bdff0a31ec01737
SHA256b56b5baee6836151761bba4314c9ceb60d80f6431a914a76ceb16a43b2c31f21
SHA512900989033525abcb7ede1a132a0f7bb5d47d22a2c9b8d6b09273bc9bb807556a1f187e907ae5570e1e868aa0cc81614488447675859bc07815711dab51e112c0
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
212KB
MD541ab6275a090d1915921b21e535b07bb
SHA134a2972e1cdacae451cbdd6b285aca5d97a10865
SHA25665f58e7eec8b5a1989b4611975c37383718fa0f6206c5d1aa53a076525daa816
SHA5126628a60ce7f05ba3a7f6088ebcb3c9ca95fb33f05372dc2b01bea0d3ba76cc0467560b19ed91bec7ff5bf9544613ce111d89bb59cbacda0b134d3f9264524f5d
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB