Analysis
-
max time kernel
102s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/10/2024, 02:37
General
-
Target
6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe
-
Size
399KB
-
MD5
fb989660e85c97608ea2113cdfb84360
-
SHA1
0c671aeeb4a4bb9e351df35d6c9687d320b76da4
-
SHA256
6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80
-
SHA512
46dfcdfb127f30031151fe8d2710314c618ab9384fa96c525c73519018a3dfa38381f1925c16231c346ae8cb56ba9c013ebabaadf733ff84f03b359b5100b57b
-
SSDEEP
6144:H4EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eir4Xd5Md:dmWhND9yJz+b1FcMLmp2ATTSsdr4NW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe"C:\Users\Admin\AppData\Local\Temp\6e70a0488dd04c1c098cf1d83466dfc603feb459dd581bc124b3a628d5318d80N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5524c3ff1da3b0f07e01091f82de5c37e
SHA18051b5944ac13f3c129fad6090b7e344221eef06
SHA256e9ee9fb0cba841d5502492c0119ab0b239e7bb646e339ee8fdf06ff7ede63f1b
SHA512dc2f12b50cff841ef24e7572a526086edae006c3a9abadb1c60fb4795bb7f156eb9e90845b1718e282208976ceb4143f2754ab6dff5725f8ea4c7ea03f8a37a4
-
Filesize
1KB
MD57ee7bbcd49dfd2dd35cce6bea59c9b50
SHA1731fb091b692be740aa68817cb5c64d9aca13a29
SHA256b47234c47b8be15827c7f27ea45f6661d6fb898060c6836397fa2cc03e36d9c3
SHA5121d783a1bda45352e902e422c560dfa676f4afd1917ad638b373c23bdb8b1d77d8a5bceef7e47eabbda2613428aea23993c235c6b5a585c4d36f83d9e7781e23a
-
Filesize
24KB
MD53a1a2ad6dec1f411ddd478a5e3bfda71
SHA142eae4db0fd236f54f655ddbb2df66188fa0ee96
SHA25620e329b329790f309e2b4728171d1333f4acdf4b6b2d0ac24febc846210e1728
SHA5124e4c824d0ae20144753cca0cdb0fab0064749f21ca23af6259db15a64ff1a0f53586a32e3d83990aab4c1ce3011b8586f8b079ac1e0240a826173b69a28d4710
-
Filesize
481B
MD513df8bcce0845a7f8bcc99079334f106
SHA1533de0d4bec87e78297816b63986013b7018b341
SHA25681d8f03b97edea402d3d5da0432c3f52e0357a8f7c5248899c439527a7ef5f04
SHA5128a29a33125fc1dab11369f7888d4b13cf48cfdd71b3e88c409aaeb80863ebf9f577af9a8a2d0b7e636db8811a15d498a1e880ee1fc6917c1c67a5acd9a2a2435
-
Filesize
62KB
MD5cb4ed3d134f05996f49fbb646dbba6fc
SHA19eae9d0a4d0e133c71b9a80df298236a1ecb9302
SHA2561952772a6e4a1ed32b267bff5528ae5c88de281c7a5985fe563b925b23aaaff3
SHA512b8140ef88376735529d8f807d794777986a6b5c1679413744a86c88165b979c591792691c04b1322f9e84bf9aaf6b738e364358f35670e445894987d8837d508
-
Filesize
42KB
MD53248443e129012f11ae80efe7e756034
SHA1443e69f72638489e8735f57111e86c5c92ed827d
SHA2569876bfb12f9a326f96badba585ff1e9e32b7e26848da437c1ded74c80a9b64e0
SHA512e4585a074d0af58b7eea775abec57e457ef7ad7ecded4ca4ca69b92fb98249f402af3c7c6c54b9ddd9f8775f05ab8b7d7555a305689f982c21942b19825f23ed
-
Filesize
399KB
MD5b77ae5e21408ea7637a8624cc7424228
SHA1eb2845883928ee34c6d0c2c46f85a0633785d783
SHA25651d5fcc68da26fdadf8206af6f511111e8e4e9d4f08cbe92e261780b76b41684
SHA512d46aeb46fa1ae4151ad2d9c6af5394284c8b988f705dff8295c4853e22d519258f66e24da2830603fcde194d698a2d458f2622b4472ec33658409ac18c66638f
-
Filesize
424KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB