Analysis
-
max time kernel
110s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 10:24
General
-
Target
b03541d2da5e5e2a5b173ea59a943db6a7ceb71fadb3a6a8e3ecd2e62f5ed43bN.exe
-
Size
213KB
-
MD5
ab3c3723c6a5f0eb3920e00262af32c0
-
SHA1
8942a6517d824795fb6d7704342e5de6d851773f
-
SHA256
b03541d2da5e5e2a5b173ea59a943db6a7ceb71fadb3a6a8e3ecd2e62f5ed43b
-
SHA512
e38faf31b0d849502c0818d5b3be0acbac3f281eca21002dda874e1828531503bbfcd6211350d4726f83e84bd9c895ca668f10d05da6d437d27e6fa96e0a5192
-
SSDEEP
6144:l7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:I+cff22qZhZcKYhc/
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b03541d2da5e5e2a5b173ea59a943db6a7ceb71fadb3a6a8e3ecd2e62f5ed43bN.exe"C:\Users\Admin\AppData\Local\Temp\b03541d2da5e5e2a5b173ea59a943db6a7ceb71fadb3a6a8e3ecd2e62f5ed43bN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b5dde03bb04f531b85f458b189e1b192
SHA1f7d2244d96d50ecca95a16619459fe804f952bed
SHA256c0962a7b177fb9fb30ffff367012425576037a54a0095edf8c28ba23feadecdc
SHA5121a3f34a9eddd55d07ef2179786981bd1a89868d47cf4d94d305edbb95ea79d28680a65e38c5938fc706a7bc5282b8e95843d25a626a65ad09d9053f3fb51e3a3
-
Filesize
42KB
MD5a97685c54669bad90540e35b1f87338d
SHA1f095fec50390e609216aa87073f7eb214cbc37e0
SHA256d2f1d76c5f74913b0e17fa89fc494d3d3d19ecf00224c499ac6eb9b1e183e454
SHA512ab046620d062b490fdd55db3726838fda724a02b677aad0626430878026a8844a52fbc29a6b56c441ee254625ee36bd8d404fee5a55588617eddc9880e425ce6
-
Filesize
213KB
MD527b3eae779094a6b01a763570e6a27b8
SHA1bad82940204f80bcbc0d255e5db4cb610784091a
SHA2567403d014e62712a625c445668f1c7518b6998819c6649726ada41ad91f3c6b1a
SHA512e8c9df41e5617b33eba7ab2508b114d6e28d46a6fa3ff5f28a14bf58031646f988bf6db044ba6748c146df55e0cfb6e7229f8dfb56b01226ed760c579f68d32e
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
592KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
592KB