Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 12:49
General
-
Target
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe
-
Size
208KB
-
MD5
3f9eca2b1cc7860e700bf95a05c96bc7
-
SHA1
7786cc432beddfaf763f2315cb79efa67f863474
-
SHA256
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88
-
SHA512
8aed405219887e6470b0196adef704f9e9b5369021e181a9e6bb495b51e859b7e4d10b50c6e335ed2724da04694d3bf078df778e8c6fc0cedd7e597ec2f26c8a
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:ybapK0JCmRcU9vVokfr
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f705ccdeee689f3ccdc117e4900cd008
SHA1225e34e5f82cc6a455dd45db100d7f0b60c448e1
SHA2561eb4e44a63bbcc5b6e25a9b03ac6e3154a175c4aa7023e6a0fa1e11383265851
SHA512d8df4a1a392941fc8df4b6d8f9b302ef3142c55a8cfa2e84df135dd895e36aa1a02d0a82ba84c5ce62ba5095f4723f3a8c44238bed4590862056aee10a50ef14
-
Filesize
24KB
MD57632a60635b112592027dec2f5d234eb
SHA142707a3dbe6937fb55db3743f1cf2540e35e9d65
SHA2569a7a8bef58ba6e4b9064d8e6950997784de2963f99ce4f4f5cdce245153a5de0
SHA5127cdadef280e4f2c39723f56142c6979baefa109d416c32df6f31f23261c1752768ce2362508736fef42daf3f2e3730a8445215c53f3f0b2c1b34e93ec5283ef5
-
Filesize
42KB
MD59bffe6035395036eea19cec3188e9277
SHA1a7ac381743fdd9183f31792280d4d0ea8a4997a3
SHA2564a44db09616bea4f583e781eb6cad7e59c68e3895be8a29086d23ee20827ad3d
SHA512f576a91a4b753e1cee8a86afd2bc4b4c95c36d60a676058c6cc4cf7735b6c49b9ef71ab500d1e67fd2392d0cb02aad3e7203b66c1d663441c770c38793966def
-
Filesize
208KB
MD5a21e1dac7ca7416f277d6592bf2149e0
SHA1a349e336208baef93350c35e7648affa180074ca
SHA256563594c3c6f04e9e082bb7963d94eb6eef0375844338d8956e88745b4e37ce8d
SHA512813b92332187f67a5526e29fb52cdf0b711bd97bf8a2b8b4c986151fe9a4f01bdcd9c2de1b45cf804516509076bac1028b7956d24d757e3f5c5ad1d2c59a83e6
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB