Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2024 23:45

General

  • Target

    6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe

  • Size

    196KB

  • MD5

    4972c5a8e8bd143dedb784dd94a683bd

  • SHA1

    5078fbee694cc26a1760c7bd2c879402b8a277ca

  • SHA256

    6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd

  • SHA512

    a21ca0550e600a4d82836d7e073c49f4fcccc21acba2f24a02b587f5e938218e4b3165682bb66abc1d2f04978b41b4a89d80b6ea2cfbf2331f35eaa5e9356210

  • SSDEEP

    6144:jc6BtUaNMtLLowRg4uLhuMXUk4m5xnt0Vu:jjuaWLJgzLMkvou

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe
    "C:\Users\Admin\AppData\Local\Temp\6444d1ed6bd869a89cd01be21819dc9c67cf03cb35d4ad74e5c6d7b6b8f4e4dd.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\gahyqah.com

    Filesize

    24KB

    MD5

    0f9459d2df5c919dbe2c74e279c32db8

    SHA1

    34d76adaf9d8b6ec417242d79ff819d71a42b377

    SHA256

    5bc18bc150b267933e135de4348bfff7cf7772a0aae6bb11314ec375191999ef

    SHA512

    326c4e7de4c2ead546f97b90635cc31fc11410ecaf8be95585b5e0324ad5f3cc1ad8c9a9697f4707108ca60ff658649cdc7942fb98ff98a0a67ce6d48f65d6cd

  • C:\Program Files (x86)\Windows Defender\galyqaz.com

    Filesize

    2KB

    MD5

    da4482946525ac38e1a94dcdf5e4ce85

    SHA1

    ed9f17efde763865c19c00a73c8de630d1cbb94b

    SHA256

    db131e9b77d977a7bccf1eb0bf5ff8acc3b7576bba1b2391013ff3efa249ef1d

    SHA512

    55fd1ffb01118197a4dcc57066a202dfaf0c0354338a9c1c6073550e58511faa07dcab2bb0237a9853026ef4d0ee4e330aab0154c99120ff69f59ebd8e07310b

  • C:\Program Files (x86)\Windows Defender\lysyfyj.com

    Filesize

    481B

    MD5

    c7e199c979d1aa71f7345ca34a455f80

    SHA1

    65c5a40163895f7e75d03be50064f90a94846833

    SHA256

    2cd8b23d44a2ee1a6f8b8b166a1ed78879a126757472a1bb67344d1a958febc8

    SHA512

    19196aa8c954e97a18d1cce2d898e139dc2fb836a6a30dac2b210a7e727ac977a0a1db3e1fbcf50a0fa405938dc05f4779123620f7d6bfdf10e31e9d4936dcc9

  • C:\Program Files (x86)\Windows Defender\pupydeq.com

    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\login[2].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Windows\apppatch\svchost.exe

    Filesize

    196KB

    MD5

    2bbe4eded10e1bc297b4837f870424c8

    SHA1

    2dc29e106d3712f6cceac460eeea85083dab842d

    SHA256

    735c20decfc07a1b5ed16eeaafdad80b1a8cd33bdddca3dde28f9dae36730a94

    SHA512

    434dd6700c4ca8bc2712cd2bd8e787569863190326a00c1a47a953e0470c99993899511aa7913d0442fa6e9cad6f59fd2d696e02c7b464361be6b58094e70eb6

  • memory/1960-53-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-20-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-19-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1960-22-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-24-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-48-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-72-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-75-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-79-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-47-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-77-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-76-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-74-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-73-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-71-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-70-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-69-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-68-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-67-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-66-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-65-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-64-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-63-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-62-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-60-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-59-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-58-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-57-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-56-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-55-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-54-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-12-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1960-52-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-51-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-16-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1960-49-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-78-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-46-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-45-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-44-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-43-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-42-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-41-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-40-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-38-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-37-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-35-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-34-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-33-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-32-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-31-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-30-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-28-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-26-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-27-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-61-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-50-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-39-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-36-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-29-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-25-0x0000000002BB0000-0x0000000002C62000-memory.dmp

    Filesize

    712KB

  • memory/1960-17-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1960-18-0x0000000002A00000-0x0000000002AA4000-memory.dmp

    Filesize

    656KB

  • memory/2088-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2088-1-0x0000000000640000-0x000000000068F000-memory.dmp

    Filesize

    316KB

  • memory/2088-15-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2088-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2088-14-0x0000000000640000-0x000000000068F000-memory.dmp

    Filesize

    316KB

  • memory/2088-13-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB