Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/10/2024, 23:45
General
-
Target
5d261a84a0cc4185e6a12b29fafacfad480e0fa47b85b8676c51fc7c401d9084.exe
-
Size
204KB
-
MD5
3203456ba52115c04fd6d9fada43f332
-
SHA1
c63191cffeb61629932c4960f08afda60058315f
-
SHA256
5d261a84a0cc4185e6a12b29fafacfad480e0fa47b85b8676c51fc7c401d9084
-
SHA512
97dbcee806a5a8a9f0566bd8ff58b8a42002927c0b635be181be12e3b41b95a2e4963560dcea44ae2140250d0a907e4fe0252091685af2529ef702fb4e763913
-
SSDEEP
3072:b5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:bLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d261a84a0cc4185e6a12b29fafacfad480e0fa47b85b8676c51fc7c401d9084.exe"C:\Users\Admin\AppData\Local\Temp\5d261a84a0cc4185e6a12b29fafacfad480e0fa47b85b8676c51fc7c401d9084.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD522967b433ba5a3c168715853c55e42e3
SHA14a7ed004e956224b7673610adeea84ae58c383b8
SHA2568b7598fcfe43a9bb56647fd9fb323135c982dc88936b4ebabecf15eb32f92716
SHA5125a8973bfc5f6eae942e63744368f05204730a14441e447604171a54ff580cf72740f3d6bc02a4487ef8c477c7535c74fd58d6677f1fd8b57b92cd032cb964d46
-
Filesize
62KB
MD52a7f85b39a0f227be3cbb35c8b06a65f
SHA1f7a23c7a130674ab155a58d2f3c6afe5cb8b2127
SHA25682d3ed086276d3e868078dbd1f1d0a8b0b6a65fbc9cd5610f7194505f2205d72
SHA512b01be33c4ae0c37f394ad479a1c63266bb994631068d9e195431084176fe1a2729cf0ed9b79e7d0429cee02b0a968158f1295fe15f13c17e4960a7a9d851d513
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
204KB
MD5a2cb1200c9ffb3a0db801ca165f936cc
SHA1e4709820802f0a6a5324f4121775ef37b66044b5
SHA256e803c4c21de5510c54af694c8d5b6423453edf658befb536b273f7ceb33bbb73
SHA512783cb1c66c1d93316a43aedfab3cc8d910a89aa1d21c88a130ff0f9afa282d7b74b1a637881e02bbae66556b6600d6f2a02441dc93b921c0a51cc1957375774f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB