Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-10-2024 01:31
General
-
Target
68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe
-
Size
230KB
-
MD5
63ae4c2bc1cda3d043d3238877f63c90
-
SHA1
c53ec3b49387e80a035698e394837139e66db68a
-
SHA256
68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938
-
SHA512
0b6f9aea541abae61292dd043c389aae902f6deedcc15a26f79753c6ce6f3580bed2d32c62289d7e880d00ee85cef1de3177c4f7eaa9be8396a4f0d9960a288b
-
SSDEEP
3072:qIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:3DAWw5NV4EBXWAIT/nw08xTm3E
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe"C:\Users\Admin\AppData\Local\Temp\68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5d5338a6bf200b7c33077f78b6e3aebed
SHA1da0c574327999c37ea3ee68489685e3608771b0d
SHA2566e8f3c6285d4f8533b56b006777b8df111732c9747d09080ca5758dc9804cd8d
SHA5128a517f66676a5787d3a4dd157fed3b89bef2e6d5c42944ff91423747d30d0952ce644b27c629ee18e5fd224877e7632c6687637e08e0e9e7f00b55d37fc7e802
-
Filesize
230KB
MD5cd8bb6efde913e2b60fbacaae349b50d
SHA1b17780392dc65237ed9ddf6d36966169e31fb143
SHA2560354b37d11ee1b683f740dfd262c444d8dff6e4b95d3f19b3422c5dde0acd58f
SHA51236dc290c38f767f3f33bfbca449dd56de2eee64935e500370f67b8b8f9c1374a04d9588bd6895ded1a53a2075d5f6bdadf8e3a394cb282296c4b68bba4bc9a83
-
Filesize
1012KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
1012KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB