Analysis
-
max time kernel
111s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/10/2024, 20:19
General
-
Target
936f63a909ab04adaed426e6b41f92284903d4f55125d6a42531044e1c3e25f5N.exe
-
Size
218KB
-
MD5
002929436ebf6d5d426cec352a0d3af0
-
SHA1
64022390e4a720bec88f308a52ee95e005d9cc6d
-
SHA256
936f63a909ab04adaed426e6b41f92284903d4f55125d6a42531044e1c3e25f5
-
SHA512
516dc23db34b511580198df82b4b4d5c3d429d3d051b0b56a0c75c1f0e35fdb877001d53001e49fd62b7ebfa2f978d31ca86bd6a2452932c3253e52d36306fc7
-
SSDEEP
6144:KEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:KEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\936f63a909ab04adaed426e6b41f92284903d4f55125d6a42531044e1c3e25f5N.exe"C:\Users\Admin\AppData\Local\Temp\936f63a909ab04adaed426e6b41f92284903d4f55125d6a42531044e1c3e25f5N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5d007daa76fdf5875cf83b9561083980c
SHA133795d21629412fe6a0cbb957ff5df64604a0e3f
SHA256acb1bc856f0dfc810b50fc619b7cbe1115ebdba9365c1ee568108560a55db227
SHA51295eb0b47910df5ecc6ff5ce18205b972b8d0535a482ae9348bdab7f7f12b98954cc934b3fdada2a333249d800b71490c322b3a2337756e4a712d66a1bf3b5cc2
-
Filesize
218KB
MD5d61578faf5f14c362118e9b253948893
SHA100559dfde72e442e8e0f48c2ca6e03fc2403d167
SHA25630937eccc936f966fe9235cfacd3887e6b1ba0b5ad27426204cff0520941e6f5
SHA512f1ab9a92e7f8b0eece1709000b720746d3c6239c10c31a8c73fdac73fe00d1b394576e077c46b48f30a4aa94663ef900a0bcb6daeb992bed2758883d1dd82d54
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
2.8MB