Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/10/2024, 10:32
General
-
Target
cd278921d2633b1147bca213bc3f2e62fcc8a9ff0eee1d4d80ae93730efe7376N.exe
-
Size
208KB
-
MD5
5e557c7efa31a077fbedcab37ddd1620
-
SHA1
f20153b18069d49ed97def118c5a2e3f1122735f
-
SHA256
cd278921d2633b1147bca213bc3f2e62fcc8a9ff0eee1d4d80ae93730efe7376
-
SHA512
c9b66c206fd46141b3074170a14eaadfc6b2e8e61015b7ce20a1be602b28c36cbfe6ae6d235514031f1fc27ecaa9effe13ae4236af9f700bca5636280f80013f
-
SSDEEP
6144:IOYX27lPBA3YDMw4lj6idlMlwl7/79C87:IwBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd278921d2633b1147bca213bc3f2e62fcc8a9ff0eee1d4d80ae93730efe7376N.exe"C:\Users\Admin\AppData\Local\Temp\cd278921d2633b1147bca213bc3f2e62fcc8a9ff0eee1d4d80ae93730efe7376N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e1d40f5e8d533770541b62504627e8ad
SHA1f45c66294007b407fa3ce2cacdcc4147e97f97e7
SHA25665c29a06be10a0ce74837b34b84eac3e6fdae56af366582fd7f501d1a7327d8e
SHA512af00924f1351227399190e8a2507afab99a19a94a2c4369c7683970f1ba2331359e34c0e37ab04f0d1ad35c5ef3cd9cfbf899430bd63840bd7cb30e3ec523025
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
62KB
MD5b25fc6ffe463ccd49b9ef32837b1af23
SHA10d7ad5e6228a95ea11a3ddd359c59a67e5ccfa98
SHA2568bed0e1490c11b7416afe51bda1432f63199fe8db2f93bad676a4ab73c6fa496
SHA51287cdcac56c20bc9872fc221eeffd6d649a1149933cc26fc5013202a4b94579a66f2d4f7d53dbad5b3ee592cdeda3df4c25edcfab5c63e461d8712e9650b49daa
-
Filesize
42KB
MD55fb69de91ad4edbd1b975530c80da4fe
SHA107c85710fba09e25dcfa0267735f1e0eee1b9e21
SHA25610613d03915cb41a38e7d42e955759fc99f4b6b8a07901be4aa8bdf4664a4e58
SHA5124d8613d26a53ab97c32ff72f3d3d037db553bde0b0b7235cfa48494777af4234d26b91f01746c3437d1f57ef34493bb284d330c61f0cfcf2a88a7e950d001317
-
Filesize
208KB
MD5a8e6874ca29dd30dab9458d8f4862bb4
SHA110a71b41d0fd5ffdff31299fdf29b96f7a549985
SHA256c97432498ad731746f744317df6897403d434ab963b9e96d0c7e02b7ac52ce10
SHA512e7fbce98b45508fea0b72e0d9944acd99af6147ff98fa0bdd9ed30ae572998bdddba518971752d9dcccd394c7c4b59bd61fb506c239c55db147a0b3e7047e977
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
324KB