Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 16:02

General

  • Target

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe

  • Size

    208KB

  • MD5

    85a275b7969afee998593f452493cbc0

  • SHA1

    2a69b28ef5e41cf580406c877044e4780887bf2f

  • SHA256

    c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310

  • SHA512

    9e1f4c05501f6579a646b346bdfa18a2ed49fb8929630dd0b59fe1d15bcee0163c5e659b3ee377493fa8a0be8d72d4ebedc8b8c284a2fd7004ef7154c4a64769

  • SSDEEP

    6144:qOYX27lPBA3YDMw4lj6idlMlwl7/79C87:qwBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e0e7cf30e803194c47b2b58ec46f5023d0929250cb419938eb3c24c9460310N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\login[2].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\1ABB.tmp

    Filesize

    42KB

    MD5

    74f82a63669396925ece87bfa0e196e1

    SHA1

    75f82b770641afa7cf58cab25eecb3ae951413ad

    SHA256

    9eb90dfd94750b2dce280328fca1ba7329ef1a5753d80b74c8c811232f7c9441

    SHA512

    c78f2f8df0a1800f30387c6a7603194155cae513c0052bbe5adec9a4e28ba4606cab4cde100df46cd9c5295f56ed55fb79036fa4fa4764596ec069eb153f4265

  • C:\Users\Admin\AppData\Local\Temp\1ABB.tmp

    Filesize

    42KB

    MD5

    0acc9144b1a4ac73dabfdeb5111905d9

    SHA1

    4a1f57da02aa42da7806948aa1aa14c7d0674ab9

    SHA256

    01d1fcb8f8654ee1fdd3f983290d5a129d193e26ad03383802a37dafaac3b33f

    SHA512

    1574bfa4247879a8da1c148f7d06897178f9ff9d204aab8c54828796561b856d1dd225aabac8c897eff9f32426fdd4540aa4a4f04accfb3b4178db546d78ddd4

  • C:\Users\Admin\AppData\Local\Temp\9CB3.tmp

    Filesize

    60KB

    MD5

    ef58146c7fb5d01a1ba80be5006827d7

    SHA1

    9449f115f507d16e0c13f8de720cf2d797b51791

    SHA256

    659ebec276fa1da6de6ba2ec9dedf018b3d05fb8e0522c72aa06f4a290e4a055

    SHA512

    2a31be04050fa11639e0de96bb65e650d9d20b2b68c449022464060cf3032d92ddb6236e23d45484cf91dff2ee99e7a794b17c168c25a0bd8a3493b5dc14af80

  • C:\Users\Admin\AppData\Local\Temp\B673.tmp

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Temp\B673.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    fdeb1fd2af59be83fe32ebd53b4944c5

    SHA1

    195978b4a9d8dd032caf8766fbd97d235e0a1c1f

    SHA256

    895cdae1600baff41ed44f13fe5210d7b64f26cd3645504e18f95dc4efa1a147

    SHA512

    e8efde408a4c889c9382cafe390b9c7e427a9d9ff3f79d0b3acc26ab2dab8ff3d6347d59c1cd396758c353600834f0abc309a4f43f4ab8992ce67734ca481b5e

  • memory/3360-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-22-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-21-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3360-19-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-12-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3360-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-13-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3360-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-78-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3360-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3360-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/4216-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4216-1-0x0000000002210000-0x0000000002261000-memory.dmp

    Filesize

    324KB

  • memory/4216-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4216-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4216-15-0x0000000002210000-0x0000000002261000-memory.dmp

    Filesize

    324KB

  • memory/4216-14-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB