Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/11/2024, 23:41
General
-
Target
fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe
-
Size
208KB
-
MD5
182180ece4741cec6bff8ea8c0c69d20
-
SHA1
bb0647c96c9d3042da3fffa6adf247984e4da2d0
-
SHA256
fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29
-
SHA512
663865540321b55e11bd8cc19a419973dca5d134b24a11bd38b7e4420502929c462f61acbeb7b1a010bdc7ffffab0a04c115ad77cea00b7a8009aeda5172832d
-
SSDEEP
6144:4a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:4bapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe"C:\Users\Admin\AppData\Local\Temp\fe5cc9b55388c8cac1fb12f7e6c403404fec0766e8a6e457a8c7a9388ee96d29N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5cf532c0ae162eb36729fc20354e0a281
SHA1dbfcaaa632c3ac756041d778790df78a3f234803
SHA2567d4bb8fe9b2dc117bc34c679d92959aa94fb146d345133bbc410ee1b72f862e9
SHA5120b72ea92430298ecf06aae03ed7b0f15bffdd8ba1155532a9e8dcbcb31668534b723e34621a392203856329286126a636d4a65af5366a172f3365fa7c9e42e98
-
Filesize
208KB
MD598854663577a669eba86ef413975fbed
SHA16246ef2e0b2fc2e72f1df502ffc3b7c6067bc4f5
SHA256ff40a2b61c07d6d494217d1015743a4455e22d4119d684660523995a883ceed9
SHA512ef8e33a17901a6d04a025c9c5d284265e2498c8a81b6af9f91f81b577c124e9638f98556bc697f5c7ea4389b8160392f69f2e79a44958e09e043a1d7ce71852d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB