Analysis

  • max time kernel
    111s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 15:58

General

  • Target

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe

  • Size

    208KB

  • MD5

    85a275b7969afee998593f452493cbc0

  • SHA1

    2a69b28ef5e41cf580406c877044e4780887bf2f

  • SHA256

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310

  • SHA512

    9e1f4c05501f6579a646b346bdfa18a2ed49fb8929630dd0b59fe1d15bcee0163c5e659b3ee377493fa8a0be8d72d4ebedc8b8c284a2fd7004ef7154c4a64769

  • SSDEEP

    6144:qOYX27lPBA3YDMw4lj6idlMlwl7/79C87:qwBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\EC1F.tmp

    Filesize

    481B

    MD5

    4f0f732507a3ce4085f5cfe083169449

    SHA1

    967c23df6dd44f1f7fa89d4acc692fc7825e15ce

    SHA256

    8cb4b7ec22785f2645b99b81248091ec3d73dae87d95765a3f4a0b1d686bbed5

    SHA512

    b40a34b7d1e2d98b2c3053fc70239367687319f66a714aa231f64ddfb5e0853a1e1271a9a59cb07fbf8dcd7133e00cb8f87eacbcf23155f26c7ea4ecfceb6518

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    5e268b8371a5e9ecb8b192ea0efbce6b

    SHA1

    bfbff31339547b9e54c54dc14dc37a1e65674495

    SHA256

    0d4f2a679bf8155c5d6b147c220efdfee4f2d68d38ea51f5b7803d870f9a0423

    SHA512

    0f6ad10efad300dab38c5cd5d6859dc725ec7fd913affc99c0a4eade80402bdf301fa78976368341512f5c0dff9638df2db8c3ca070e53d7a3a950a431c67240

  • memory/3496-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/3496-12-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3496-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-19-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3496-20-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-22-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3496-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-13-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3496-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3496-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4180-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4180-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4180-1-0x0000000002230000-0x0000000002281000-memory.dmp

    Filesize

    324KB

  • memory/4180-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4180-15-0x0000000002230000-0x0000000002281000-memory.dmp

    Filesize

    324KB

  • memory/4180-14-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB