Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 07:08
General
-
Target
fb2278c9953ef4c1a8a04a730e52b23c7230c37af897b93d783cc67231a4c891.exe
-
Size
212KB
-
MD5
78d19bed6d452f66b29304e1f63d0202
-
SHA1
3e13880edc8eefb8daad2218b52ca3a906eef4cd
-
SHA256
fb2278c9953ef4c1a8a04a730e52b23c7230c37af897b93d783cc67231a4c891
-
SHA512
93feeba9ccc88668b8bf67fdac03c44e6b788a494441795a8d270baa32b4ba99a478aaa5d402d8d9be4491f2e92dceed38336d338885464762c99cd96cf2837e
-
SSDEEP
6144:xob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4G:mboEj/8ASWM4Ki96/zqIKG
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2278c9953ef4c1a8a04a730e52b23c7230c37af897b93d783cc67231a4c891.exe"C:\Users\Admin\AppData\Local\Temp\fb2278c9953ef4c1a8a04a730e52b23c7230c37af897b93d783cc67231a4c891.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD59306a979e08908eeef391dfbcae48e93
SHA13b3451ae48b9849e4c1f5069f5947463b05e30ee
SHA25612816e1debfe0eb1b8eda9a2f9c1fb14d1ccc4643ea27767c96a597410af1d34
SHA512f047d2cae7648c62d2cb6476752439399674182d0cba9ed03afea0cbf8b44850596654f486ab3a0b5f3adde993e9c4990b2012a8182315a26e2468ac6d06142a
-
Filesize
481B
MD5f39d4656f266f148d7e9aa69d474740c
SHA1fdbdacc835c077cc66ec374fcf39ee636fcbc411
SHA25682ce46d77269bdad913486d38e54ddfd1599aabd8a28e598bb0af5e06a285a2a
SHA512eae9763ce0a1c1f06ab81430183b850a0ae28f05888275f45e61a529de9aafeae7fb5b8a424eaacc7d1fad64424b173a7613fe0e040e90880fb548145ef8befc
-
Filesize
24KB
MD5cf905d7d4b25504a6eaa76295159eab4
SHA1c4c34b7597138989afb18d427545003cfe50e35e
SHA256a756c7881857569af5e496c6b7d00166d6c6877fd9771da4d70f3cb401b67943
SHA512f0a9c8a75e12945c799b8c178652d69ea03a3805419d5d9ecc07162b40a574027e75e4aa2dcba7e62dcd613cb7676608958f51d14bb0a31b0d8a2db69cb87486
-
Filesize
1KB
MD55f0e5dad61a93d4f346e5943a5a804a2
SHA12f84b52c6c67dba0a30ae506b75a00c21a2a3146
SHA25678cd82fbe4483eb6df0d13a5d79b8c776f8d35a0c44ccd29a6fec276ec72af2f
SHA512a3d8ede6b6b163bf60dedefca2319f14677122cbf237ad1610e23856f18ea306b5addec08e38cf311b94c78dbc24d673cb3f31f4a8e0813c97b68dbf2789a6c6
-
Filesize
212KB
MD5d6984908e765c0f3f7d57cc4a50800b7
SHA1ac8908785f1ed0546761470a98a555efec85801e
SHA256d03d4c6f6e88f3cbefca1a75ccd6487e427c1f8b6f09a59973d57c1748c07c27
SHA5121be1fb50fd51842c12145cbfea133b380ce5e474ee88728534c7791e0ebe034723e197fbd84cddef7ca4ab920f952128e552200311a382b52f631b24ef66cbac
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB