Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03/11/2024, 03:20
General
-
Target
25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe
-
Size
205KB
-
MD5
fc88b5f30c713cde267c4c8bcc7b6a20
-
SHA1
6bb1abcaa31be22450e525f7d9191380b5010f0d
-
SHA256
25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984c
-
SHA512
18760580d3dd70b83bd77525b324806b2fa41bb6dccf1ad3552369e1e2f3282b4fa7996012ec48476396e3ad0a351346e5f10b4fe120bb04592284d48457e4f9
-
SSDEEP
3072:R7VD4DUHnNZkfOP6sfIOpJ9C3hPlGxt1UhRkgyankTIzfwAYzWcXCyqT36zhRRKy:zzHnMLm5GNGxHUhtnkdpHqTKzhh8i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 36 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe"C:\Users\Admin\AppData\Local\Temp\25d0ad1ee406759b3cd58edf5ac48f94bd892e1daf7150b0a3634b406c33984cN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5dce20f0f356f3dc3c573e5c688392d4f
SHA127b0007effec9f1dfbf6054e0680932230ba6d73
SHA256dd3954d2a70bfec5aaee9f6d15dfc7a44e1fe9e915a26fe9f61c22851d71f68c
SHA512da7a31cada0398d75ea97d8c34e5e12f0ad6b210cd3c9c4e1d3859ee720574029636f3b586b6f4bef6e30347918a39ea2d190eace6aefaa23f9e5accd56086a9
-
Filesize
481B
MD555ed2a82c611875e2ca7a6475d2dfdba
SHA1296d2657cd644cf26bfe897c87bde8c5d6cbe8d4
SHA256459f2c908a4a6f5cd776f032b3715266271a1fb0ac14ea4905359fa360efca5a
SHA512a1fec34636c495fdd0fc54c53c624c288dd3c64decd5e3f3372fb794f5531832802d333119150b8d721d2e0070df09b6a99fa25eaafc2d666501cb6021c4e17e
-
Filesize
57KB
MD5e0206dd09e2c3d68601cfae6bddb0251
SHA1b881c5dd5260bcf00b037e5f34be9f32450090cd
SHA2567247b61c90affe047ac1a5cae7df2061da8533a7ab305079d799dee2f3aa396f
SHA5124c3db3ea96ab0173d45943df5dafffc334d312cdf520a6b41c4906d5ea3d28649b337c592c29b99b20ab6503d9a43d17ccab3c479d5b7caf6563e325cbfd8443
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
114B
MD5bfde1e9e9c32c1681a16139450c6909d
SHA17e669b927e6a75a10a0ca29e38e58ddcb49b725e
SHA256e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a
SHA512781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
205KB
MD5de0a7b833c2c83fc337ce7063213c3c1
SHA15a36f781626c51c833d111e8717f2162ed207841
SHA2561612b2ccb10088173b85470025e7987a28b4f2fef964406c2868f6799a23784c
SHA51227da9cd97667eace614b711f458ba248119e1dd4876c4bb273f83e3a97db59fa8a32b7c29d4d27e01a5cca6323f854d2655e28c1999fd64847df4e867cdaa6a7
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
552KB
-
Filesize
656KB
-
Filesize
552KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
552KB