Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-12-2024 03:45
General
-
Target
d296e049cb14756050ef9d93d5b4475036dc32716b3ce24b68e15a6e9a4e255e.exe
-
Size
204KB
-
MD5
f137685c54480141fcd728e085c8d7bb
-
SHA1
346f5caa98d13d6d6f592b0772f7cf714a71e6f7
-
SHA256
d296e049cb14756050ef9d93d5b4475036dc32716b3ce24b68e15a6e9a4e255e
-
SHA512
4f2c1beee46dca57d2b78b713c316f2779e51a77cd07971c64bed208928d8fed9a1d1c13d4f8fe10c1cd35a9dc7d32d5efdd9bc5100ca007e914a34bc9ac63cd
-
SSDEEP
3072:15u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:1LexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d296e049cb14756050ef9d93d5b4475036dc32716b3ce24b68e15a6e9a4e255e.exe"C:\Users\Admin\AppData\Local\Temp\d296e049cb14756050ef9d93d5b4475036dc32716b3ce24b68e15a6e9a4e255e.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD540071ed0f62903aa172a241ae0242a30
SHA12bdf8d033e6b3f942b110ab76cf031f246a279a4
SHA256622ae54a61b22b3f76a8ca8a53be06236845943593762a7f5a2f7006d9fdf6ef
SHA512ced4020d46c95ac034c4e750b8ec02e180b0cd61d4e6401e0c71db7449f851993a09fd4381af79f1c138075bbbedde456f79e5b417eff2567264d5fabaf68ecf
-
Filesize
1KB
MD5d95bce8097e2a52da0e922abccdb1b3c
SHA12a80be6f187c074473b5a173f01e6fe9de569d0d
SHA2565d0b162f69d1314703caa7c3ee4a779a021e52f8cc96840f1546c3bbe695107e
SHA5120e1347aa1eedf32ae55e3e3f2b51eec25671968a40ae5c30da50e8de7d3273f57451ee461195e76b80ffa69fe34f214de804128162f9c27931ee19c37353df12
-
Filesize
1KB
MD508f5a4564f81cd63691102a23035c585
SHA1fab7152c3f52ed0f950423c1887bad7681bc07da
SHA256a00ff694e6a71134c158f7984c1fc747ba3c9a3385384e67126ee0e235a26bef
SHA512d2f649c89d474a70aab8483b95c4c75cb6114d76a18ba2c2aaaee30d764fe2aa89fa760d70c6f3cbd043840c2b904cb2df338b291db844f4f149d2989c841172
-
Filesize
42KB
MD574a2339dae1df27b48ec9440d58dd4fa
SHA1cb394a6c11e1e2866ab657ec39cb56b219f25121
SHA256543e9451625f5d87e30fdb88706ece894a65fa78a423a1b7733c64a28926c91f
SHA512abbdc12ac951cd4b45f62111ee5c97df2fd9bb07e929aff44897d2a081c4659daeb90c14e459456b097789f892feecee12589d91a15ca9fa76f4add5dc7afca1
-
Filesize
204KB
MD585b4002667f5ee6db408953af00a6fee
SHA1c9caa202acb3a56678d539b0d8ffaade7bc973c9
SHA25662e8a10fe4bc5ed3fb238ab9cd3f23a3bf62924adc5dc314c8586c2fd4eef8ca
SHA512d747e4ec7eb760278d7895672080f90cba52ed885654cb0b8ab280f747966d5de0732782130c461015278c683ee94410cb0d5eaee5188493781d523156e72ca6
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB