Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 21:37

General

  • Target

    731b961a706aed56f7e1df7d9fc37b8a0624d1f97f1809d9dd47f8edf1242a37.exe

  • Size

    218KB

  • MD5

    96167bcbc4c7fcd5bb9dd87657f84002

  • SHA1

    276077fdb30a363a8883d1359e100b068660abb2

  • SHA256

    731b961a706aed56f7e1df7d9fc37b8a0624d1f97f1809d9dd47f8edf1242a37

  • SHA512

    675c17a20ad077dfd5dac0db872f722cf7f7e4a306275d2a094928476a6dc301909dac49f5ac575d6581e6a3061f5fa08ab29538a595d5d6c210049bdefee731

  • SSDEEP

    6144:yEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:yEGDdQNHEwWlMxYG/wI

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\731b961a706aed56f7e1df7d9fc37b8a0624d1f97f1809d9dd47f8edf1242a37.exe
    "C:\Users\Admin\AppData\Local\Temp\731b961a706aed56f7e1df7d9fc37b8a0624d1f97f1809d9dd47f8edf1242a37.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3536

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\8ACA.tmp

          Filesize

          593B

          MD5

          3b03d93d3487806337b5c6443ce7a62d

          SHA1

          93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

          SHA256

          7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

          SHA512

          770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

        • C:\Users\Admin\AppData\Local\Temp\8ACA.tmp

          Filesize

          593B

          MD5

          926512864979bc27cf187f1de3f57aff

          SHA1

          acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

          SHA256

          b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

          SHA512

          f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

        • C:\Users\Admin\AppData\Local\Temp\9791.tmp

          Filesize

          24KB

          MD5

          2726ecbc3a07dbee92d7df1220844f93

          SHA1

          9807d1ea1868caa7601e974f95e047a5c22cda98

          SHA256

          840fc392b68f8f3681607babd49091b4ab30c0ca6c454ecc2b16b70e4f4294ae

          SHA512

          1558b3c9e884a4cadcbc815ddd6ce86d372310b7a88547aa090ea208df926749a87765a314c226b73e69a2be52d0d7c6f2365a6bcd6a44c3a06510f0c4447c21

        • C:\Windows\apppatch\svchost.exe

          Filesize

          218KB

          MD5

          e15c8392d14b3f1800d721a876a86146

          SHA1

          792ead7bbf54c0cfc9ead360d88ee038d7219d7b

          SHA256

          32e7f644ca1514a8c5f4df565b4baafcf20350be010cb21eee43d501954d72b1

          SHA512

          3672265c5015c39004c2deb776b8f467793dcd3c071b840e139a3c0b4a4da9d8caf9e26520f66f86828b755d2839e1f8e0d080b8d9f51f00d7bbaad8caaed08d

        • memory/1500-0-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/1500-1-0x0000000000980000-0x00000000009D1000-memory.dmp

          Filesize

          324KB

        • memory/1500-2-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1500-14-0x0000000000400000-0x000000000045F000-memory.dmp

          Filesize

          380KB

        • memory/1500-13-0x0000000000980000-0x00000000009D1000-memory.dmp

          Filesize

          324KB

        • memory/1500-12-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/3536-60-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-55-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-17-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/3536-18-0x0000000002C00000-0x0000000002CA8000-memory.dmp

          Filesize

          672KB

        • memory/3536-19-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/3536-20-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-24-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-22-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-28-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-33-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-79-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-78-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-76-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-75-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-74-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-73-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-72-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-71-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-70-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-69-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-68-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-67-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-65-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-64-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-62-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-61-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-15-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/3536-59-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-58-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-57-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-56-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-16-0x0000000000400000-0x00000000006D0000-memory.dmp

          Filesize

          2.8MB

        • memory/3536-54-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-52-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-51-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-50-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-49-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-48-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-47-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-46-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-45-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-44-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-42-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-41-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-40-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-37-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-36-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-35-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-34-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-32-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-31-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-30-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-29-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-27-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-26-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-77-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-66-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-63-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-53-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-43-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-39-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-38-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB

        • memory/3536-25-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

          Filesize

          728KB