Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-12-2024 12:55
General
-
Target
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe
-
Size
208KB
-
MD5
3f9eca2b1cc7860e700bf95a05c96bc7
-
SHA1
7786cc432beddfaf763f2315cb79efa67f863474
-
SHA256
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88
-
SHA512
8aed405219887e6470b0196adef704f9e9b5369021e181a9e6bb495b51e859b7e4d10b50c6e335ed2724da04694d3bf078df778e8c6fc0cedd7e597ec2f26c8a
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:ybapK0JCmRcU9vVokfr
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b68104112989d6a53e518083513dd369
SHA1d80d0a0b7a5936b693057b4aaa0437d08518a303
SHA256bca8d585d3b34b7ad175a1af89b36fe004a76662eeb53a5f8d1109c5c48dd23e
SHA51205c79f2537ce97f5b80f813323830276036724e7468eb8d932992aa45827bb281c42e7d4c5306eaf72cee75099913eacddf3436b99e85244ada589dfb5cc9bcb
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5162ff5eb4e1bd6b093501fe03a316dc9
SHA1668ae745cf2ea0fd6def75226c6a4ed011c60449
SHA2560de15d1a7a98b2ca288e67d6031050ea1e2d5dee186c5e61c0a2b38afdbd42a1
SHA512ee057f4a3c7639c86d240a5c5f1b7db9a8f4943ae53a6c9d6ec274dc409101850e4b578a027c527f8aac4d718409f5ec9175d713c7798a7faec26b65e88cce7e
-
Filesize
208KB
MD5b3f8154f1f159af1cb9006576c2d9374
SHA1688847b6dd931d139b700f0da6dd9e0e41982669
SHA25623227db68932fcf8ea079c48ef1e285b5761e2c9ab9c2bbbb2c6851bbf36e30e
SHA51227df36c9518b372e5fef93e45d0b4d3b4d432c4ac24ccef9f73b462ddb55d140fdc402159078146d9f96845117d2b9a50b97e214b118f406a1222d077b09849d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB