Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 03:28
General
-
Target
a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe
-
Size
208KB
-
MD5
777e60853d32b173bb5446d74243f397
-
SHA1
9af4fb89b95d4cb84651ab0e070411b49fd171d1
-
SHA256
a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa
-
SHA512
fdb2331b18c14e4155c3ed5c40b672fc7a1d2cabe691dd4ef364b8ea182ad25e47c00364f09b531dcb28f965f59f66ff22b4c6e3ddd6787a1c56fb6b1e0069dd
-
SSDEEP
6144:Ja1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:JbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe"C:\Users\Admin\AppData\Local\Temp\a5473367003595b2d8a370ce95a8ade09bd1c8f7b22b10cbde83022f341928aa.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD56bd3660d8fb9d2bf292cf07c293d1b61
SHA1f1e7b5f24f4b830374b1c5486be465b15c487ccd
SHA256a3c13ac044a64010915f0f56ce10ef2bf28dca2cc4250f7513c8b6c9e53b3c17
SHA512dddf74d62babe9e365b8965dea09835053e035e6425d1816227cd869d4e3c62fdf45b0daeeeab7f34cb8ce878429f950ee586babd8a1ab45aada8b2f7ca24d93
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
62KB
MD5a49917212f87fe89f14ab0891f9f6508
SHA19ca9c56f064c0757518af53b2d24e00ce921b890
SHA25607b9aac6e7480218a2b8b81a91f76c65fdce7a2bf4655f54f5408999fa6412a3
SHA5120ef55b80f5797cedef2e4b40931d46226dc69ebf25b77499fc91563b80338c13cfc0756b6dffcf19e4f7ee7d0471388a3578756cf607bf8f6d94439865b62565
-
Filesize
481B
MD56b80caf5d6cd48974709e2734a4e4de9
SHA19c98fd829f3cc1a8b4721447606cbec02bc94b31
SHA256597f1a2f367d0feee845f822a30733effa5056a0c12ecd5329fada18422000dc
SHA51294114cc139401e9ab8e592e374da09680fb0d4e70061c0b2fd4023e042476b9f937d2e1299e9bc6b56969767cb06c94545fb963d3fed1858dba499c2030a1274
-
Filesize
208KB
MD52ac7b89854fe6cba9d97bf47850b4025
SHA1edfabab06d876854b0399dc821337d07a85cb95e
SHA2562b1d9f373b6c3b8fc802a8d2e97ef9521c5205ecbe48ae38be814e0a66462d1e
SHA512cc0a796da7d728b2843a338cb0bf994b364860748b4920f07544289d931e767cd492f14c9826564f76be6791519b6aec9455c3a4d1430a806bdd711c1975894c
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB