Analysis
-
max time kernel
116s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30/10/2024, 09:52
General
-
Target
f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe
-
Size
230KB
-
MD5
94a9a3777e967eae3dd89b5ce5642c90
-
SHA1
827ef7d402f9cad442d96bb2cdf192ea298e5e3d
-
SHA256
f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609ab
-
SHA512
a3eac6e9c366947061046225369274bcebc4b2c0bd7def8a8a59b1134faaa93c8a48cd52158423085bf7c226ac1ef5ea22c3f7cc9cc1564f915a698ef202f7d8
-
SSDEEP
3072:uIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:zDAWw5NV4EBXWAIT/nw08xTm3E
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe"C:\Users\Admin\AppData\Local\Temp\f769fcf3131c1cd9bbe155c827371eca3a9b07f446729dcc939d27a5703609abN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
24KB
MD530a9755a577aec42334cbbaa8dc1499b
SHA110b4f3f62e34193a2c20941e38ee50bd1522791f
SHA2569fa076dfef99d83b2333b42863c110abbe2eaf30fb5d1e39d5b735e39e0cb6dc
SHA5122ab62b0f2c0face35a15247755bf53a86a49d30e4fb022be9fadfe5054666bd5d844639738fcb17523166e9623976b0a18b5dbd95f0c3146e0a13213b54df50a
-
Filesize
60KB
MD58117b1698cbbc659b599735cca925e63
SHA10b86c957cee6aa00a148f640d48e48e5557941c2
SHA256f84f5a69a92692369b02e44de97775464a0b69a3c32e1e487ba1958fd0dad034
SHA512256abe6daaffd1b0daf3cce6d04d1ad8b5485b687e73d890897537050260e7f531d826d70b4c52d0875a3f844b558172f0b10dc8a3d8103953c109d989744d6d
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5d054eb1a90a6662968736c37d5333f22
SHA1518905ddf0c1a51b819dc9016e600cb0378f7529
SHA256809a8ba0cb4aa259288abc6e03fd12dd38713a19efd681531eda97cc43d15459
SHA512cb3eefb71d5a3a9b38a24f659095bca37fc74fffbdbc350e841288416b58f35c5596e8b6323d319af0aef55455acf8386c1eb359f42ca037014b69b4a22b7afe
-
Filesize
42KB
MD515deec2ceee092b558ca793caf22343e
SHA1a23fcc93b0eab329139c7f166fa0ca9d821a576f
SHA256b68f9b0393498962ed01bc3ddd8cd6ff2020e69738eca63ed30bd59346cc5e1e
SHA51217e868cda76bd799a63a1dfc43ffbaeb1fc45cdebcee5087229982a684f27e3f22e60e921fda67558cd9513b0d77f39888e4fdfdedba59d4a0220c0ff698ff79
-
Filesize
230KB
MD50ed156f1db6547db5556268bb1e5267f
SHA1e1a9ab8df27df0fdcff0c7b381e497d651780f63
SHA256c42f1472697ee8fb8891078bc9ef949d272f0a9561f2370d0d98574bacbfb5fa
SHA512fbd6286ffb997f42a2d9b17bdf60cc8a2bcbcb44f527ef9beb939ae9183933195431b2e213754d8a68dc4a4fd86c7071cc9e50525d06f0e9c4a40c2654182fd0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1012KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1012KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1012KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1012KB
-
Filesize
672KB
-
Filesize
1012KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1012KB