Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31/10/2024, 08:21
General
-
Target
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe
-
Size
711KB
-
MD5
e90f568a0e48d2f12a39b28bbd0d3ec0
-
SHA1
533b490046adfb0b6df4302e387291b819ba3f81
-
SHA256
273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81
-
SHA512
16f5f267abd020e98990956fc33d1a783dd298acb1cbb2d99d1b218dbab879d42b488744c091e3e3bc64a7b6b11551760d18416b78addbb07886fc785960ea93
-
SSDEEP
12288:gmWhND9yJz+b1FcMLmp2ATTSsdNmWhND9yJz+b1FcMLmp2ATTSsdS:gmUNJyJqb1FcMap2ATT5rmUNJyJqb1FB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"C:\Users\Admin\AppData\Local\Temp\273f329157240081d9f5188b34d2ee48ee812593dcfb3e27142642ed1d51da81N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD514abfbd6f71ac05b3f89f8bb24f96332
SHA14bbf1ba5ec31b91becfed4f8990e758affa8b3fb
SHA256491a8ce2d27f5c39eb9052d22eb1cd2da7e5f8187bdd6eba7826e9cadae481bb
SHA51220a6c171c66dc0f602a2b950fa88b5ff547b8b30301188c6a661824186fbfb879e661cbaf4aa02608c22883970c3807ddcfe477276a18c6a1475548ea97373db
-
Filesize
481B
MD537de6de55c3f1568ffda3a2008039ec1
SHA17362996599119aff0bdfadd6b6042a7e5ec5a4ed
SHA25683cdc271767b34e9d5094509bc9004af650ab55fb49923dbafa74434e0d1dd0a
SHA5120f4e15236df6a081664f909549823a79c70717bc2cdde91bb5fda6b88fd19861dca1b36ebe570defea5ed133c269fd900fe041c43886b97d12de210dad36754a
-
Filesize
60KB
MD57042d98d7fedfb26c26ffdb648416687
SHA1b565072f98bcc6c426deab393431bdb1cd77f96a
SHA256ccc43a68f9dd32461be61a8b437d66bffc3590daf93c0fea3ccbfdd5d5cbdae6
SHA512654c66acd5e0b1ee72e22ed26f6d0d8a8fc0cb49cab5d49af1bdc5e3effe32ad40e4e5f56d172e9e464d7853eb17e22f9b2302321dec049950be3d875b5f2bc8
-
Filesize
42KB
MD52b5f60ee9556c3fae503afd3a9133434
SHA1495b81a7d80e507dcf14ab81e237146cbcc8b6c9
SHA256ec8dfdfc0ddeadb068389a5e8fdc6f9091f48766cc667ae56cdf61a3c1be1a1d
SHA512b06ab58da166e3ec8594c1a7fdf51cf012a9709e6e74bf084daa15094a885917fa20c948fe71312f600e2e4ce7ec0c3c7d3aaede3506fd13a58fd1d526592d81
-
Filesize
481B
MD574bf33320195c6a3288ba5e566e6e6ac
SHA17fcd1d5934447540e182997e6c5f10e0ca6298a5
SHA2563fec5d77840a7abd4e9139afbd7c265766f9ee93d943bdbc002e826892342615
SHA51284243872f6f38e2cec2e990aee3b34fddaa168472e4705a2134288ead8c29e759f1e637e3965bf8988733746ee117595cc71bfb0963b4e02dfddc1c52474eb47
-
Filesize
711KB
MD54d7169a033df0dbec5f8967009ebe206
SHA19dc945c108e94ffc274e1da59d55297844d33071
SHA25638ad759a734a132a78c6e04e8ccf75ab4c3699a4d49c1a06fafd5706966b43af
SHA51212ab2624b54dc23c00b5c769af509e6a20167cb32a4d9e6ec41e2a0a4d21ff86ee19da6c92c4ccc2d08502904041b128e4bbe522e98a4dd6ddcdecc20335fab5
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB