Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
09-12-2024 20:50
General
-
Target
37bdf8a52ba703f5477eae6cec5b387f9dc5a71464f7071ba500959f6fbca9d0.exe
-
Size
208KB
-
MD5
20a898ad31a23b0148ba13afddc6a6b0
-
SHA1
bf3e6d54f7836c7c080d23ec15b90b3536fff35d
-
SHA256
37bdf8a52ba703f5477eae6cec5b387f9dc5a71464f7071ba500959f6fbca9d0
-
SHA512
a57361e59029770c5edcc0f508cfb207e8e4970514eef95f67597a6354ad74b1d92dd0be9c1d55bb725da870eed3a8f018c2af7a2916d2565f2f2a6d52a2959a
-
SSDEEP
6144:qa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:qbapK0JCmRcU9vVokfD
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37bdf8a52ba703f5477eae6cec5b387f9dc5a71464f7071ba500959f6fbca9d0.exe"C:\Users\Admin\AppData\Local\Temp\37bdf8a52ba703f5477eae6cec5b387f9dc5a71464f7071ba500959f6fbca9d0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c6a0f709a7e6278d688530739ebd09af
SHA117cdddae74797931359e9b35ff04136c3141164e
SHA256156972b57287bb78725780efcef1e7217610a4130cb6c3157eafc0ad0619853c
SHA51238622993b75a21a558ee0ca2a9611900090618e3aeeb2e74eebd4f6e8fbfa75948a140692c422eece98c00a32271793a72fcbcd5a23da685a3fa1433738ca324
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5bad807998e26d8160382320e57c551c6
SHA1fea6364708ee1e7a234a94f7cb77b239304162b9
SHA256bfb6061c87569ac2c9c72c624bab59e91f39405a9f407ebc3124da3ccdf3e110
SHA5129d6c02280a3ebece31ea746140903824612aa2055f7831a29e234fd19ec465de9868d2b6b15ab0d7c70c878fb394c46a89288d73c9322d9cfd6737db6d3254a7
-
Filesize
1KB
MD55f5b84a8ecf5a179a94322db3e47c79a
SHA1e660e6b1bf81b435add984fc9a387eba6ded2cce
SHA25674746ebe5fc43b6a48972094db7de2bcbb9d2c2e5e81c88302e1fc3438e56162
SHA5124eb24bb02c763cad22e4e09c2ade98c7e7ec0be5ac0b6cc61f12afbcb702cd9759ba3e7dd39e7eeb1d77fb5f1ed25d239c5aae436913c5a093e25e72fbcd43de
-
Filesize
208KB
MD51d89ff39325aa90030d0b3ff7a9d15cc
SHA166e7e4ab76a7e8a95eaf776237a36c7113740d7b
SHA25619c8d6928668dfc9ea466eb3997b5e9b44d27d436a366b1af09d661f0206b13d
SHA5122ee265c6ca4e7aa739a8171be202f33afb74be46c5a1725da30736c004b3a6d795a2a8a5167c5a906764dcff3a93b4e33d60b4b1d8b1e5daf4846d900fb9b9f0
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB