Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 09:18
General
-
Target
5717f196e5f4a1e5f6f51a3dafff284024a49675b6ff8ea2d8997c9f15f8c192N.exe
-
Size
218KB
-
MD5
a7bdfd7b12c65ea8b9aa789826418430
-
SHA1
3624aca2daef1a18748caa32c7c888e0e0ac8c37
-
SHA256
5717f196e5f4a1e5f6f51a3dafff284024a49675b6ff8ea2d8997c9f15f8c192
-
SHA512
c0e6ecf48f4317db45fa4ee8e3403d90bea10f8fe22477737ba9247bab7849d98f72776b06b3db6cf7f58d9865431f7edda76e53c431e76789e44960d757a900
-
SSDEEP
3072:lvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:p1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5717f196e5f4a1e5f6f51a3dafff284024a49675b6ff8ea2d8997c9f15f8c192N.exe"C:\Users\Admin\AppData\Local\Temp\5717f196e5f4a1e5f6f51a3dafff284024a49675b6ff8ea2d8997c9f15f8c192N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5bfdfc4d840d9e9ce3e8826785d9e520f
SHA11ef13816e83596213a00be4d163380e630993cc7
SHA256b1f2e8c62d5a1f73d3d2e902040422e7b40e17583ef86a87b7299f22f3ff6033
SHA51218de184ca9878b8a525d4a02b65d16d3cebb1f61de0fc915248b83213bc4c90c953bc21e184c749a4b9bdda11abb586957f8a79ce243d1e1105cc9bed3a81514
-
Filesize
42KB
MD56f317aac7c2fee0ea745c0e0c46d5dc9
SHA1c6168f26e95c819e98077b2a8b37a87ef01a580d
SHA256e03a10d42846f27b11008866da1a079e419aacc7bc7ec33a4c5e7ae196e6de78
SHA5123219d37ef4a3a35a5989ee3fb34da0ddb01ae5f7c60d7c9a5b8cd10034c7f9aa707fd984140883a890eda86c751fc637d0db85dfb19091736741884261bee04f
-
Filesize
24KB
MD5d5abba11f36f13c9a58f34251cd107a5
SHA11532cc47978eae9153146fd343abc35795ba744a
SHA256cb8c17e216c7b07708fe44e45d337a06e5067029ff7bf152a8e9d8eee683fcff
SHA512fa161571cd72d20da583f834c1b0ac57daf9c5a949787702ffa8de088596356f3ca922d90878ab86c677d75e8c8f2464364d1659740823c877d88cc8eb93e27e
-
Filesize
218KB
MD52a88b86cddb2a7f2d00364f3199b785d
SHA1acf253abf5446a2320df21a3b383f37815a57b9e
SHA2563338b2b9f3ebb1c0ecc8fd228ce8c6af323f2e275c461ea7ad09bf67e0c010f0
SHA512c767b468f488a88e8800af201fb3f436422755d0c0610cf324b65bdf2090dc50d646ae44d409697595c7b10bdcd8570b377eafbbf75c8b5453ba883ec48fc2c6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB