Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/10/2024, 18:34
General
-
Target
0cba1beed8ba19af500df0398c9f5e99b09d01d3363f8d4efa60dae5c71ca64a.exe
-
Size
205KB
-
MD5
70e5f8bbed283bf196e622ac3dd10fc4
-
SHA1
0554e5f687904ad9baf845972b18419fc0dd86f5
-
SHA256
0cba1beed8ba19af500df0398c9f5e99b09d01d3363f8d4efa60dae5c71ca64a
-
SHA512
d8ab31b14facb3d7376b6573000d738164024a462b1984ab1596cda9f6d64b033e427d626a4e6f3a23e2a948231f126413e3b9cdda1f0a436b3429efae8d9df8
-
SSDEEP
3072:o7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:uzHnMLm5GNGxHUhtnkdpHqTKzhh8i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 38 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cba1beed8ba19af500df0398c9f5e99b09d01d3363f8d4efa60dae5c71ca64a.exe"C:\Users\Admin\AppData\Local\Temp\0cba1beed8ba19af500df0398c9f5e99b09d01d3363f8d4efa60dae5c71ca64a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5aac814cc6c9d091debd0ab6e0dfb491e
SHA1b4994a3e258dd5ef4391f16b59fd530ea34d6d00
SHA256dfa808d6ac14c2a3a5d9bb00615437f1089eeb1d4b0ab38c96186f29b21c27ae
SHA51257960a039fb38a78e3920811e8a8c14b734da457fda9143c5c6e948ef87f4160cf1f4530146d9cbd956eef98d234e4512a8616f94272086fa3f285918ae25c5d
-
Filesize
41KB
MD5c9ea24fa3f09691dc8f8d74efa29b1b3
SHA1aed8d3d715a5ba6324d709dad255eb1a3976479a
SHA2566373c516aca0c08f45b45c6293118f8cbb8f8ef48a77e7acdb2dcbaa8720ef60
SHA512070ff1407454afee05b2fc7554aececbd3309c14cdb2c66bc87296f4a942d71f0c9c5fbc7653b9ee84b26358b4022026dc0926cd9d1cc95c57352972735ec092
-
Filesize
481B
MD5cb73521b091d07bfd4c62bd4a688788b
SHA1fe83c6bb02ed989b2b8193888fcb45e459fa7e1c
SHA256d49746bef544716762edd7b929c97ab7bce111e79f4c268c058d88dd5401d0eb
SHA512d3156267ccb1f2030e2d25c5933cd31be9ed5863eef80a8f0c51cd0c202e6bf4e5656b57058c6facbe28c6b87fadd8ef794036764549c18be0c7a6c90452b77d
-
Filesize
481B
MD5be330dc1a8174fa21cccde81a957e3ef
SHA10320eb262b887e690b7071bd1d18692a83eec984
SHA25644a226da52465448447cff5c4139232e0195b45a1f29c76c5dafd84d7d0eda05
SHA512a411c965dfae03f64099d5045a9d6a0d52a38746d05ea8ee5ab3130e1fe6a4da0ccc3372389310a86dbb390409e645e96b46102e8f6d48594dd1c9120cc219dd
-
Filesize
1KB
MD5f25eef7844714181fdf9acd151961a17
SHA1def4ee0861afcde2f49d42f50e895aeb73f404ac
SHA256f8dc351e5e5b5f745a9a26332fea213acfc3f679ac9ab60e514473da58472c4f
SHA5129f1e651a4ee417e348948806a5175f0ec896cfc2c9f42b429dd947dfac33e5d666b93f5fc1e0e7b4164631ba8007d426ce6c451d6daef10cd0826c9081f6c72f
-
Filesize
114B
MD5bfde1e9e9c32c1681a16139450c6909d
SHA17e669b927e6a75a10a0ca29e38e58ddcb49b725e
SHA256e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a
SHA512781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396
-
Filesize
62KB
MD5827b7dbb20652aee39cc9e8263ac6b07
SHA1b8d6cf5156e28f06488e660adba24dd2e51b4a0c
SHA256bb7c96482b90ef229c0e79c190d292ba5e6c766290ba5cf21342cd72cfc167fd
SHA512538abeb3fdef3d11faaedfa4b92b027556e5891e169a9131165a2f880d856a70824eed7253039d5f840ce5b2610f6621f8a48b94acb2f5d419db0952f8a86f51
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
205KB
MD54d02ef80a1eba3d9e37cee0e432a55aa
SHA1995da74c4eb8fb5e8ee9ea075ce0dd2c964a7303
SHA2569256d0546bd81a21997a2bb4a9e7ec5e468f6d51e795430db54f6baa79531381
SHA512399fab2ba8261917d98b0e2c5dba09dcd7b056e1caf4514674871e3213167cd83792c36a5fa51806153d36e5ec77e7c389b930a952d9347555028772cdaadeb6
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
552KB