Analysis
-
max time kernel
113s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/10/2024, 18:30
General
-
Target
c5921228f1952274e77c290aa6ed60c4c20532b3fc27b322a8cb828e91b03fccN.exe
-
Size
218KB
-
MD5
96fc4d6ce691c09617120d4bb7b96230
-
SHA1
b3499cb6c21f6fa97508f3f86e5fa5b697f832fe
-
SHA256
c5921228f1952274e77c290aa6ed60c4c20532b3fc27b322a8cb828e91b03fcc
-
SHA512
c1c7802bc69ce453f673eb5b85da9485cf21b1333d4a10dad94f57f7a0b56933a74348ba6f19525ca96029241b99c675a7aa1e381f5dc2e80f4a66fa6b9f4c41
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5921228f1952274e77c290aa6ed60c4c20532b3fc27b322a8cb828e91b03fccN.exe"C:\Users\Admin\AppData\Local\Temp\c5921228f1952274e77c290aa6ed60c4c20532b3fc27b322a8cb828e91b03fccN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5cd2dd22f31864f7ba8afc7cc09597251
SHA1fd56dec2742726f807d6b66fc77a293298040e9b
SHA25649f8c09d07f90f899be7ed579d6283d4bb2b1df930e85fcf512d6903adc7d386
SHA512beb1dcf6d869d4770483ea96e4190112c7a6cfe33d335a9f4ac0cd883477d5686a90040a5f80863cf24deb6e7b45efea8779c2a895b737bcdc8cea344b123d65
-
Filesize
41KB
MD59f1d73208267740df76d1878770fafd7
SHA192b58785c3400dd212d2bf50e140bd041cf542f1
SHA2564fc76b9e0313ba76d1a570fc697c9d2e624eea6e387475153337b0dbdadae368
SHA512d8c977f9dc14a191e79a2f1a188b632369abe1e4eae74baad019e4846f4bd548f240c5f6a4c5dbc61fed879dbed7065e18c7c25bf31eeb4a20796ad933af83ea
-
Filesize
481B
MD50f0e37302ae1d6fe2fa2efba8adafc9d
SHA126f314a4e46bc6d940db21475d4e55fd2a8097d0
SHA25650f8211e00d7138140adbd963c422842104523fc355a7e91e8e2cf29fb640687
SHA512209d05e672cea3c5a7de9a9d78e8dc40e2fce611878153514ed7ad0712e90804fe5fa6135ee189e9eccb7c072f4a76afa7bb496701712087f15e701468ee702d
-
Filesize
2KB
MD5dfdf23384af46e9cb4e55e1f1c8d0020
SHA10087089aa99c56171f95877870c4e75cffaec369
SHA256f87738fe0e5915d593102f8afe28ce2514b4bb3a59cb9ccbaef4c33c221bce78
SHA512e8cb8bd7153d0a7231524efcac4e6c4e72fa270c46aea3c3ad222a709c1acc13812dd0a65961976156ae64485b4509cf7cb2ffce004e93848f95cc2beab613d5
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD549c52f4169d12f33cc49ef2f975a8eca
SHA1031a9f30a02a0edac3570252b618ad45563a46ad
SHA256a266fa8babaaf07ff2ffefc00173f2157c909a366a6a8a958f5760c3349ea672
SHA512cfdc906ce159771983a419068b522e13cad956bb63f9debab2519313d12f6102d87c649b23ed5b6a2f0d3c69fc7902de87d6f94c30c1a3ed22ccbf8ae9eb9b25
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB