Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 20:06
General
-
Target
1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe
-
Size
218KB
-
MD5
5371937f45ef141a0a7b34404ddeb508
-
SHA1
2c57999aed57290420fe7c09a02a8f9c7f7f9d39
-
SHA256
1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456
-
SHA512
f6c6739f3bcd4674153fbb710fc816fa01c4a4b92557917c3d04394647768dd0f5757cd22a11e49ec4165ca8e9adb50e94201f5009e91bff41db5bdb06fdbe64
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe"C:\Users\Admin\AppData\Local\Temp\1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b22719aafdc71ad74a0756c42166758f
SHA10b226a4d4f7a5cc0ae4286d010bd3646ec315708
SHA256cd436dc2126ce72bc7a4746f2c72f1e0586e0de4905e0e61256264d06df44484
SHA5123bc6e66ab98425befb66e7c73307d9faac7971aff6663f059b8012751b571b3e9d85a1bf02f21b5cae6d9b52d345706548fe7d980d7c0048d62d88e1f92efe64
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5dc0a756bcefdfafb548409b75702bde3
SHA16dc2091a6bf870dc71bbadf52ff721811c49b07c
SHA25629e7e7990dc3d76c2b8943a1b187eef3420260e3b41bf6f6f8532549ca45c6d7
SHA512cd6b406fa2815e0f88aa2521b52dfd5ff30c831bc2be40f91509ead17bfc2a12040d8683eee3b3e7e0872ff9ad8ad10e3d606c62fb0a719e65cc5a5a33d5dd49
-
Filesize
1KB
MD5f5f0856884cc3a5b8bfe7ae8020574c7
SHA140e5c8597e084f3bef6fc5574dfd0623ed754050
SHA256deee69492dc2a7362118c217f15b7483ff04f81d3a789944550474ee4b56f66e
SHA51212196197ffc29650bb6c11e19e8ae597ac65e0c2fb5d790ad410775a26f426e33185a6dab1d153bbf9beeb9ce0fe1ec40926fb329204c8ddd06cb1f616302426
-
Filesize
1KB
MD52c1cf373e9c875314ac86a1a426c78a5
SHA155799b7f06784c1b2dbdd4bd6d57f2a9585fdfed
SHA2566623fe38afb07003d4766177a7deb88be11c759fc36d18d3c4a29a6a4c9469ed
SHA51280538340515a6ece2ce28fa706ddc34d99b6a4531494afef2692bbdb0ef78e89231cc803d5fc3c184fb2ed6b5bd74a7c1541752644cf1beb4d5c9b1d5eb0702b
-
Filesize
42KB
MD595af9092dce4db55b74786678c939205
SHA1cd53143dd5a91f903e796097d77b17738b4d9948
SHA256cc7d21bde2b105a2ff140794ee042ab11fd03370adcdc81e351c79150aaef7d2
SHA512238b358ea4492e2f9da6660771307c592e0ea22ff44e7a533b92c51c7edfdd3f502f5b122a988cb7537a34b54e35e868e4ec8236745365ffca9b392c257cb0ec
-
Filesize
42KB
MD54e03111a8f74b30e5e899c16853b104a
SHA19ee9eaa88edf372424f8f724782a785d05c354a3
SHA256694d02dbab49db0c3908e7b537e9a5e8c8de58aee8a95eed21be753fc1806f52
SHA512d41bafdcfe302836dc4631a9d1a3c347b01088be61b4d42d02ce69fcb29183ec7fd89d4ea3b50e34498d9104f8e16fafd8b06bd8f24f57217f778e838667ec21
-
Filesize
218KB
MD574a761ebde56d56eb2edc3e3760714b3
SHA1330911179eb7c171660411dcead510d3332ef42c
SHA25640964f50678aa8db29940d818cd36c2030f672126a77c906fb5ae2f133758cc3
SHA5129b274069a12d51f5f30babb3835e2f230876f91018954a93ec2739f1b63307125b7b65e6a4980bab04f00bb446a07ae4c9a93f231327216cc5fe6e04b1144aed
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB