Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 00:13

General

  • Target

    6fbe53707778ea9361ac4821053e97349d88154662d1ec109438e5d419ca1fb4N.exe

  • Size

    287KB

  • MD5

    e4384104bfc3a00e340e017b3d02f3f0

  • SHA1

    b1498900ce80e1867af46598b23f0a768856dcb3

  • SHA256

    6fbe53707778ea9361ac4821053e97349d88154662d1ec109438e5d419ca1fb4

  • SHA512

    534772560fb75b6f9e64ecd2750f6404074b5149556672ee72410ca7ca699c66ab45320858b77932ea0e4946d185921342bee594b475c7581f531ea25d6553e5

  • SSDEEP

    6144:Y84R+/nBQojUb4LoaXqMKVjNY4GuKcxwMwulQMEAj+:ZhBQ6n/SVqxcxwDunE3

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fbe53707778ea9361ac4821053e97349d88154662d1ec109438e5d419ca1fb4N.exe
    "C:\Users\Admin\AppData\Local\Temp\6fbe53707778ea9361ac4821053e97349d88154662d1ec109438e5d419ca1fb4N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4572

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4572-0-0x0000000000400000-0x00000000005C4000-memory.dmp

          Filesize

          1.8MB

        • memory/4572-1-0x0000000000B90000-0x0000000000BEE000-memory.dmp

          Filesize

          376KB

        • memory/4572-2-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4572-3-0x0000000000770000-0x0000000000771000-memory.dmp

          Filesize

          4KB

        • memory/4572-4-0x0000000002480000-0x0000000002532000-memory.dmp

          Filesize

          712KB

        • memory/4572-5-0x0000000000400000-0x00000000005C4000-memory.dmp

          Filesize

          1.8MB

        • memory/4572-6-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-10-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-8-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-71-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-74-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-117-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-115-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-114-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-113-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-112-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-111-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-110-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-109-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-108-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-107-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-106-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-105-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-104-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-102-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-101-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-100-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-99-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-98-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-97-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-96-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-95-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-94-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-93-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-92-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-91-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-90-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-89-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-88-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-86-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-85-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-84-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-83-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-82-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-81-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-80-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-79-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-78-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-77-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-76-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-75-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-73-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-72-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-70-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-116-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-69-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-68-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-103-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-67-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-66-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-87-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-65-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-64-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-63-0x0000000002AC0000-0x0000000002B78000-memory.dmp

          Filesize

          736KB

        • memory/4572-191-0x0000000000B90000-0x0000000000BEE000-memory.dmp

          Filesize

          376KB

        • memory/4572-257-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB