Analysis

  • max time kernel
    113s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 07:28

General

  • Target

    645ff3fc239974b7cadb8daac36cea3aca65d4182d7977f865d904e43ad78988N.exe

  • Size

    208KB

  • MD5

    6aef8fba0a6d5c2a58a2e1770ea83d30

  • SHA1

    f499c3e797765fb99899975fee23044feec3d595

  • SHA256

    645ff3fc239974b7cadb8daac36cea3aca65d4182d7977f865d904e43ad78988

  • SHA512

    cad83ce027d9cc7615b0b3a788e2c93dfae715c6f3d68be6bc8bc3561b33db3dcd39a5f979eab4e381e13ca319ae58f151f3c5a8c4c7ac0dd0ceb8e2e71564ca

  • SSDEEP

    6144:aOYX27lPBA3YDMw4lj6idlMlwl7/79C87:awBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\645ff3fc239974b7cadb8daac36cea3aca65d4182d7977f865d904e43ad78988N.exe
    "C:\Users\Admin\AppData\Local\Temp\645ff3fc239974b7cadb8daac36cea3aca65d4182d7977f865d904e43ad78988N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1F17.tmp

    Filesize

    60KB

    MD5

    e9170d6bde2184c422a8d46004e0854a

    SHA1

    02e027fb761a88a1ad93da14ea14ef0f2e5b977f

    SHA256

    c1fe17255d760f4da8e20b7914ce034c172a0aa44315efd69b06abb33e999157

    SHA512

    e8a8399e20d62a67dc5d9383f351a43115e676a052f4922f86d71826172c15aef307d0e772d47e3e450fdfa28e0d9ae6cbbcc53f680feff2a649f3b8f9e71a2d

  • C:\Users\Admin\AppData\Local\Temp\1FCA.tmp

    Filesize

    42KB

    MD5

    b4c188c0d0f608f0d8bfc76ceb390694

    SHA1

    16a27b6fa5418e7a19468af406564ead9f28970f

    SHA256

    07b6be0b0a9dbe0e35046ab62034363a08acadf4f1562ab2420aa65dc9b491a4

    SHA512

    6e4b619b19dcbfcc46d37af45dac0985d72bd891198584de602787dd37a1649eb6150f19f5e03c0eb3b0fdd003983152e912f184a9cd380fbaf3d2d2b9179013

  • C:\Users\Admin\AppData\Local\Temp\9D59.tmp

    Filesize

    24KB

    MD5

    61c4c31f07a9c4c5951c4d6bb7d05717

    SHA1

    4497cbc99b23aaecd3071812deff0025553cbb5d

    SHA256

    87893d407ede6992eef3c4c15fce030c8cf101a4eb2699e5243e0b01ef5ac7e3

    SHA512

    dd49404fc2cce6117fe3ee2812921484f24b9b0ff72f64f8ea346e7fa9accc26a820da76ad1c91172cd13b8ac1e278291c39fbf584142c628b483e5c8267a51a

  • C:\Users\Admin\AppData\Local\Temp\B98.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    11f58e99a05fbd2aa04609bc433aad5c

    SHA1

    4c261cd4393225964f06a30f66973231190f0b6c

    SHA256

    70fe8e740e9e082701e0d681f00bd18e663c492af3f60d23e84499e7367cfd6d

    SHA512

    dbc7bf9753c67248fa4a930299de6e7c6b7fea4eedf51026e369457b27e72fc61cadd43794e46e326c4077492b3c9b09c9ee7be1660b5cc26d5bd64e116ebe72

  • memory/2832-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/2832-1-0x0000000002260000-0x00000000022B1000-memory.dmp

    Filesize

    324KB

  • memory/2832-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2832-11-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/2832-12-0x0000000002260000-0x00000000022B1000-memory.dmp

    Filesize

    324KB

  • memory/2832-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4612-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/4612-19-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4612-20-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-22-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-78-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-16-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4612-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4612-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-15-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/4612-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/4612-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB