Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 10:11
General
-
Target
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe
-
Size
355KB
-
MD5
44cf7dd8d6409d75db36c31c3ab4fdbd
-
SHA1
bc5a205df09a32e5a38f22a791510de6b12b96c0
-
SHA256
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f
-
SHA512
8a815f3ab5417429bc0437191e8866aada6f89c9cef3cff46c1b6f4a3b70ce6e5119ce03e0e736aeabcade008790274b2af247c87ef6ddd098f27446af4af057
-
SSDEEP
6144:g3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei6:7mWhND9yJz+b1FcMLmp2ATTSsd6
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
481B
MD538db5c38a328fed83092475bd1f60d10
SHA15a1a1046ce793bde34167190477a84981cece263
SHA256f342638f5776fcacc6c3160fe5fa2135202dc18ea37d04919758a1f4128a9354
SHA512c2574e59f16b0942a6554853701e6825a1857819835f95092a9a2f48188f9be9aca88606ba44b452afc171029104ff24453cb7835ffcd4186c16e4fadafdf6f5
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
57KB
MD575ba79a5fd45917762bdca67912662d8
SHA1273cda366859ad255418541a616ae577bb88185c
SHA256889c624f7cde09476383d8a268ff0357f80b3ec634fd1c55f1cf8e9deb56b573
SHA5124bbaabedb3b7c6ea1026e1bcebacca55ddee4df067aa0b655e74e69370409d985561e84a2f29e85525e237601d90661a7a681a9c2832afba5ee6643038af4498
-
Filesize
42KB
MD5101f8523df727d4a99f63c4219037835
SHA1e83c3b634141002cc476b9defbdcd3c3ae5193ac
SHA256ab1277ccc3b141a73451b140108869050db5344efdeb123bb2e7b40d10225a5e
SHA512a0156a0079b940e91a2c3dba4e4cb343134cf10458512afbc17d21468aae7341d9756a771e78b14768edc1a945463a387aa62959259da009a4580210de9a586e
-
Filesize
42KB
MD57bc096b18555affb1ae2fca9558e0fb7
SHA15957ee8668ddbb2594abe9e842ef5b0eb6ab51b0
SHA25653285dc44793ca465f3fabfb4452d03211d4418268f4a82dbad42565a1b11cc6
SHA51205e6d3e07b73354e8d8f3fdef03cd287b48ad883db566efb2ce133c7b9598d01c22fcab170606c4467788cf87f71c3be7903292a12fd4a3c9b5a3e51345fd54a
-
Filesize
57KB
MD5333b08e010202eec755303b82b67d685
SHA1b0792002d2ee9b5c2f508f6192e278995c990f7a
SHA2562babef1d755d72f1cb4338908745bda5752e99edbcab6186ec2e777063b65127
SHA512dad74935171172724e97807a65b7e70ece4752cc368dc6a39caf84debba5d157332d13ac043e23e8c1661b5e5105f3d8ce90a7706c74ec91fc0edf24c00a8ff4
-
Filesize
481B
MD5291b4de92a67fdd74eb1651b41394a20
SHA1d1952a31b6610504a7d9445c81f582c302a9de15
SHA256e64af5e06757149b6b114ee13ff745988ecafeaafab7ba6fc6381346fafda609
SHA5128cef1f89023c9a2a64e75f5c28c22db96fb66f73d9039f1221188a5feefc25720eb7fb8962978fec68a2602bc4ea71cdde3040b5380c6432b36859a28d394acf
-
Filesize
355KB
MD50a9e87d5b0f2e477504c547107eeb0d0
SHA1db745dc0e5260c0901e97a5194b3b7ad70af57a7
SHA2563f629780b3550e30309ddb3b8ffeea9e18a1c5d54f6a82ea5eab6042c0b6e0b9
SHA5124a951358dec7d1a1957347bdd25038cc94533f95d1956f8b520cd0625558474f0e75695b7dbf42a096e019b8ecbe777f9359bf5b554ce0d186fa84241b2d7dd6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB