Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-12-2024 02:53
General
-
Target
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe
-
Size
208KB
-
MD5
1ae630c9073650cfadaf1ce8a2500ff1
-
SHA1
f6719008bec7a1f9c52557f3ca6cf5301dd0ae35
-
SHA256
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77
-
SHA512
07ed34719dc16f95a13a928cf03fcecc8f375328caf012e4e399a1ca51eb0ec4de01c24cf8cd5c637afa9778b3c4534632a3e39c2e95161a792304bb3043e72b
-
SSDEEP
6144:BOYX27lPBA3YDMw4lj6idlMlwl7/79C87A:BwBAy0rlMI5i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD50017b1b7f2d5d38b913c8e5019b1c396
SHA19d192ce5600ef30a53ce2f5d41668e46b1c4d926
SHA2566d7cc36d6bfab5e53606f22a628d87f45bb8bdfa35fd1595795096d9a066e695
SHA51266949bf70181066064de195bd8842fa35c21884154955404ca907171985fa10cd37f00684d0a4a276db061c3efea06b9ac891eac8a49f4b30590a6d96e870c41
-
Filesize
24KB
MD57dd726bee16a16753f35566772437fad
SHA135298be3c07d1b4f87ed17d371859eb5899ff838
SHA2561cabe477680f74b908ed662ae15f019e5902b01aa7628b70fd526c5863490480
SHA5122ff2e211407cc171a56f04024e9e322be81ab983128a4995dd3964f6c2273880ee0420a2f4df9468dafc7bc45c961ff23d75548a608eb464ae0101c80edded53
-
Filesize
1KB
MD5b47bcfbbbcc72bf39f70489c7e55c69f
SHA133edd92b5d72649177d837c6e610b70e4c302f96
SHA2562e932f34737db81c17967bce393c43c2f7a19d8b3a97edc302393abb0384f57f
SHA5120e7608a79b4538c18c628a1245b82b3899ccaf2e5282722f6b6bc07b29f48a61c459c231a99a03c5a4ef3aca0c804d922946560a9f8d380f1f9d89347b4450f7
-
Filesize
41KB
MD5decfd45592901f0f15d41d0fdce7f7a9
SHA1bb4d28d49729060138f252bb745be36946dcd048
SHA256690c7815d14600f8cfb2a382b15b7610f0186506b8ab6ad62a2909bbb61b9600
SHA51269bbed84a407c5a4a726d51822f219487a19f7963df347a4f1d31c8c63b96ccd2994cac99f9ed6e9d7bc444d4be7b3b0217246379e6bc336d9e493297631675f
-
Filesize
208KB
MD5dd41144b9450e66ef4c5ac8c7094f0d0
SHA18fc2686e269a356ff941444249d3285f22db3003
SHA256a8b061da3b5c68266be3b7b4b386e6e6896fe8c0d746f93bfe93cf652198a0d0
SHA5120cbeff7c79250d0c2fb8d56b12b437b6cd589edb9b91648aff073bb2f849a4d5ca212cb587508b95a7bb7eb0a02692b041886f8e93f64cac57072bbf634b4c4b
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
728KB