Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/10/2024, 02:53
General
-
Target
f0ff73257eaa5fd282ce619ed8d17a890321229693243db61d0764f9994e4f09.exe
-
Size
218KB
-
MD5
df5b59430be08d53ea8c6ecadf24f8d7
-
SHA1
f0e111e9aa689f9fd1f99e469e880d81a6d91c73
-
SHA256
f0ff73257eaa5fd282ce619ed8d17a890321229693243db61d0764f9994e4f09
-
SHA512
4deed9f169207d1667723a916cda8d5fd3549f22a85ffd1933dc51bc62fa9661e3a746dd88fe7eaaf9dc207810a0a11f552d4cef82c37ddc1346991c8d52e8af
-
SSDEEP
3072:xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:11SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0ff73257eaa5fd282ce619ed8d17a890321229693243db61d0764f9994e4f09.exe"C:\Users\Admin\AppData\Local\Temp\f0ff73257eaa5fd282ce619ed8d17a890321229693243db61d0764f9994e4f09.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5daa8b365b59e24c3aa759a218cf47f00
SHA1f66fdc45ce5d57aada1f08920e75df118b355a55
SHA256e196ff9e1653ad6d651f3e0bac67a055d2b014ae6fc5ee7cf0f9724f8c155cf2
SHA512e700590b606dae5f9a22f35de58558e575483c1fb335d5f7960028fe178ad69dda63e37499a509ed0d1a1adcf1a1ca97bfa2836d61748e61b04a6076822c79f8
-
Filesize
481B
MD5d38250569372545a72bf624b3cc00a12
SHA1c799d8cb120cf97a6e767ef28ae41fb92cbc698e
SHA256fb7277a873450c7daae4edc1ba76caa1323f25a15ef731d043c1815b6bff22f3
SHA512d8f9186e85cb078c3dfc1856bb394fbdc3e80c9581150ae55e07d482f9cf76b559ff37a56bedb6e06d08b3473cac7134bb6e3d692fb92fb9ef0eec1e73bdddbd
-
Filesize
2KB
MD597a653c94d16e3229e4dce449c651a62
SHA18f8c74c10b171451ab76e45e51529ddf31d0338e
SHA25644db5f836e0d61a7fd181890bd79dd6cf1f185efe7c0bdc5d57d76eb5be268cc
SHA512928a097308f15c31c142905f62ef8e9dfaf9895541456fb3a252212ba9fc887d9ac2ea3e81f94c91f86dcb376985b3ebc93fe79b5c5e598cbbaefbb2503e5d40
-
Filesize
218KB
MD5e08d48bbc9011603f98a389840bc46ac
SHA1e4c8374216523e36c9b2077b996dbbce53c506f3
SHA256dec2b58fb40fb2675c2309869d0b0d786443d1dd81eed18cc9a2580377e59129
SHA51205f82891eda733a888e06b42921ae83673f7c9f1d068d930b6dc24816255ec98de7610d192fbb58f727a5605eb00756f4f3729570b20f2c7cf91e6962ab6dd3b
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB