Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 09:36
General
-
Target
169e61287e7c38cd2f039125d2e9b1d8af8d71d2444d5819c3c28f9702c7fa50N.exe
-
Size
380KB
-
MD5
cb200a88d1d022add37ea259d0a2c9b0
-
SHA1
05a76b5c5023da97e93f24cb614256498eca472b
-
SHA256
169e61287e7c38cd2f039125d2e9b1d8af8d71d2444d5819c3c28f9702c7fa50
-
SHA512
69bdf7d9d2347ceadab6c280317ba827f780e1a96a24b5c7803184c4f106486ceba1bbed130084bd058adfe66c38180974a2374c8385ba584a160d62544145a5
-
SSDEEP
6144:SaEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:emWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\169e61287e7c38cd2f039125d2e9b1d8af8d71d2444d5819c3c28f9702c7fa50N.exe"C:\Users\Admin\AppData\Local\Temp\169e61287e7c38cd2f039125d2e9b1d8af8d71d2444d5819c3c28f9702c7fa50N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5ec34e04da917f96f181c04954156b635
SHA1c5702190cc245eeff2501898bf659c1a354bf111
SHA2563f2e5df8c31a2ca77d844a02e57f2e259aa50959de0648605da54e2e2782491d
SHA512ffed46436c76a055cf06128f9f9aeb7c603fd38334a876919e07ac13e8df465ed12f478c3199d82775cbc2ff160bc194b0fac6c0b312f5bdbdf39a04afcffb6e
-
Filesize
42KB
MD568e3495b019cf6ac6774436c63d8c3f9
SHA1179181203a32f6ca23c8795426c7b5714e51eefd
SHA256744d2973469fc8d6a62c8f4483607ea47dbaadec64938ec0ce0f006a011dea77
SHA5127afa359de22ddbeaa3656965cc17b913fc11027d37126a1693d5adca02b96af0cab182291b386a48b62aa6950fec37eecac0f1464546b85b31a2c2c92fdee6aa
-
Filesize
380KB
MD5fd7be6a45b47234f1d1cffd6e692096d
SHA1fe8d0f92a8dcaedc9c5398947444cb7888affdff
SHA256f95b36dc0d2326bff7fad8e99053b33c11d55bbd7093e20bbc31138a541ba3d3
SHA512936b2c5d235e0eaebd31520bbb200b7d7e22bbada34f8660fbac0eb577aa950083a0f5528799c3984bc7b14578257c6843ae3fea05a23d2aa95be07f28350501
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
428KB