Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 09:55
General
-
Target
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe
-
Size
355KB
-
MD5
44cf7dd8d6409d75db36c31c3ab4fdbd
-
SHA1
bc5a205df09a32e5a38f22a791510de6b12b96c0
-
SHA256
f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f
-
SHA512
8a815f3ab5417429bc0437191e8866aada6f89c9cef3cff46c1b6f4a3b70ce6e5119ce03e0e736aeabcade008790274b2af247c87ef6ddd098f27446af4af057
-
SSDEEP
6144:g3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei6:7mWhND9yJz+b1FcMLmp2ATTSsd6
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"C:\Users\Admin\AppData\Local\Temp\f9a21f40a2e6ee28bdcc41fcf8a4cf3d509e82948e6898b340f6b70dcdfe0a1f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD50c09dc4535e3ad82d619e34411d46e24
SHA117228f2418167252ae043952577bcaa2605fed9a
SHA256105b286f1ebda9e39561a9668048e11897fd8348920ccc204e96ea1737d7b53c
SHA5128908a123d1538979c047e32d7d8e6156d2aba600208878c0cc603aecfdc45ac6ea191c0f0cfa99e158896d1957193293bf6e63cb1777955efab358c276c8550f
-
Filesize
24KB
MD5fcc6a7a22b545b829eb770cb2c106a42
SHA1d2137481f54de6b4ed4dfea00d9ec1f1767764bb
SHA256a8a0cd12309c5ac46623c5fcca4b1e9e59764c32ab744a32bccd337ecc6a5f17
SHA512888d2f298a40dce7570da8bab7d1ce05adefbd7f83444a4615778f9a56557912f1934bb8a8caf8953a0c9751da2d2a14f2e70d620f00866c9d351783eb1ebdf8
-
Filesize
481B
MD54115af8eb856ab7b68007554ede012b9
SHA1ead5aef9284681e47b81a8de7327c44ce5074977
SHA256a403272831330218ef0756a01c9ce25d3eed01f0072216d60a0666ef4430d120
SHA512520fbe999b256a57605f02661f368735c0a51a0645ab93a3c448ef26f93a357714e54c5609ac2b68d57cebda2d29cead89934fbe03364d9899054db340d55dc9
-
Filesize
1KB
MD59e611a30615721275401cd3eb2baf114
SHA1d5bfe86dd3eff549ff0747ede11c85e25d8f4bee
SHA256d938656f0091bc973b14b07fa3bf4d424154549dfe8637a49a22b724bd52eade
SHA5127d2eb9e8b15d4a1a2136da40a74d7542ccc09e61357f728e84123413a676bf42b26b6936449dedee5d55b97c39ee4e83f6233f08254d4d1e5859d0bf81dcf560
-
Filesize
355KB
MD5b1e9533b4483a644ae934914e8284614
SHA15719170cfb2b2e3a855fc190afb4aaaadde81290
SHA25682c3b539aa54df5104a302313612c101e66ec65e690470bdb75e53caadb5033e
SHA5125eb4d436214cfe32de4803c1c0cebaf18f482372fba526dbf0efbcb01227ca279aadbf20f1edaf1e45e8a25db88822d979a7c3c9faec91c5d324a708f394879c
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB