Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 12:44
General
-
Target
904d1e156a65d8d443e9295cca6ece545f25299b69adf99cdc1418c6475403a6.exe
-
Size
380KB
-
MD5
8dfed84605e1bbbd0be29a7626ae3849
-
SHA1
6f4484f453be735a774e5af3e85214887c8389b1
-
SHA256
904d1e156a65d8d443e9295cca6ece545f25299b69adf99cdc1418c6475403a6
-
SHA512
2706c2381c4b326d2aca0a3b88f988acdffc42efaf83540afde7b0bbf38998d19731b2f7feef09f896a05eed349efabaaa26908922f43c091212a4d483eb6eec
-
SSDEEP
6144:KaEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiwmryP:WmWhND9yJz+b1FcMLmp2ATTSsdwmryP
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\904d1e156a65d8d443e9295cca6ece545f25299b69adf99cdc1418c6475403a6.exe"C:\Users\Admin\AppData\Local\Temp\904d1e156a65d8d443e9295cca6ece545f25299b69adf99cdc1418c6475403a6.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
57KB
MD588f6f9dfcebebe8d5ea1b6391226fdf2
SHA18f3af378d5b01de14d625ebae2f23d706917ea49
SHA25646e63eb58776c7a1415dc4c8436d4a54d6cfcc5bd10acd07857aa33deb5aa959
SHA51281c9cf13a14fa72b3940bc0297da11ea2ae2d49181cd2ab8ead1dada419e1666ccd3bd57ac4f2083403b43954cbfd37f1586c15e393b7041db9ff1635cf9c58d
-
Filesize
41KB
MD5c55248bb2b365f7b0791a60a54a887b6
SHA14da53266ac64840f84da6fda66888031f0721fce
SHA256400002673b50127b1149e860e0b4540cb37896e9201e7bb587eba370a38aab68
SHA51268f5b341661fa2d26ee192ec2ba9a6d76aa4d07d86e96ef3ec58eeeb991db6ea7069a86a3cd085427cbe531d0180da4aa4895cd3f3c4f6286499d5ceaf485f29
-
Filesize
380KB
MD5dc2c2e6a5cf5575f4e69b8815af2dcef
SHA157c88f2a9d65bb17a186b5e3c47d572d73017f9f
SHA2568c6c8e847a92a7c101efdf1f1d068318bd8da5420e4d46abaeddcb532d4a07cb
SHA512639d59befff8db2ac2ab18b09b59f399bf6c7c23bf6f9050ecc2dd66977e8d351e7061105fb116f3a44114b1ec664b53a7e043ad9372a7f1c58e2e41857f9ed1
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
428KB