Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
7f3bba6deb15592c35327e56b117e588809a379ff157e4bdcee6fd03c25cc1ca.exe
-
Size
212KB
-
MD5
0bcf19a2d8c75e5f1778ff96903e4ce1
-
SHA1
ebbc4bbd138c4aec0224034cc18b5dacc3334114
-
SHA256
7f3bba6deb15592c35327e56b117e588809a379ff157e4bdcee6fd03c25cc1ca
-
SHA512
2e97f61c42cbc41769436117fe86534a93dfb4c82ac40bccf81de6f50c6d2c79876e5dff5ba02acf68da789fdcaa652bbdbd8d8a828c3eb316cd6e422259b275
-
SSDEEP
3072:AGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:AG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f3bba6deb15592c35327e56b117e588809a379ff157e4bdcee6fd03c25cc1ca.exe"C:\Users\Admin\AppData\Local\Temp\7f3bba6deb15592c35327e56b117e588809a379ff157e4bdcee6fd03c25cc1ca.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD55e238aa34e09756567581decb5c527f4
SHA1d9b42536ce6727bb63b4ccf2b5563ea18c5bda32
SHA256649b5067130401bbad36c824bf0fb06a8a1b24f4c80ced9c4a4ad847e9848024
SHA5125e78ab15bcee7f1c490e4c575fe6319989390374f67b25411eca7beed4cc258d944af2cc2124e8c578a375f1e86adcbbcd0b275a9f02a9fae0488dfb4a1c2256
-
Filesize
42KB
MD5a536566cc8ed70350aa16e8917c98297
SHA1e8dd3d7a78ba271fa0e9478985b464f3d743f62b
SHA256e1c5810c2743fbf44f1b80597dffdd5324aa5aa5919f9a553a92e6cc9ee386dc
SHA512e7afabddc2c1bafa0a98ee971d4ce1b7a684895962c144d6b87d058115ca7a31a68cfdcc88084387a7ebc91b0b452526fa93c5aa6794f8d3e625717702bae1bd
-
Filesize
24KB
MD5c328144a6e7976fa97eb73d4ccf094d0
SHA18de32765f98d67dcdbe4806bf723e6e794eaa6b7
SHA256b6c3735aa547b59c073f54daba0c65ecc2455de39df95f3be5eef49961f0ea30
SHA5125e9292bcfca1ae126756927070f9c1b3a38cf391fd69c305b1ae6e4543d29a80fb41e50aad00ffac788d7ecbd5c941780a1347ac88b116f5101a8ebae72564e5
-
Filesize
481B
MD5546fc3ec74d0dcc19794d3197c69f835
SHA1cd8d28c7d600698c4f3125fbdd79975bec3c660e
SHA2567a89b78e0325e5489d5c6b1ebdc4b763ede2f7f99cced31d2a5dac45e31b33d6
SHA512dc7f5e028859ff5045e53afb4657a97e99355ea2fce5aedac5448b982efbfe2af43c58f845673ba4c3244f6cd0acf9bc1899c4d5bb1f92ad674ebdf46c13a544
-
Filesize
212KB
MD59b0f1c50aa740bee350131e82776a8fe
SHA1e174359d4d2f3b49fa39805904521f1d93ac7417
SHA256b375ec4394a930833559b09b014857b427f3e8f32164727477ed1e46e58d9dc5
SHA51283109a70eaee4c446d5b0ea184a14c989f37cce586a011e206e69e95079f7d2deff33bad7403df22f6bcc2a1e9f5b502b8d746a6548e81b95f2f80b83bd73416
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB