Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06/11/2024, 04:25
General
-
Target
ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN.exe
-
Size
208KB
-
MD5
a82b20470d488e0b868a1f61e27a57f0
-
SHA1
0e8626114074d99af8a59275e15c3a19c60e7087
-
SHA256
ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fb
-
SHA512
7225160a549a731355b67deabbf1bd50ea74c7c194855b0b6a8bb301b94763f6422947ae947efc0af3fffbd55594f27cfbddec15c9c30d21226b39a3f5b46ac8
-
SSDEEP
6144:Ea1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:EbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN.exe"C:\Users\Admin\AppData\Local\Temp\ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD560349ff6f5067c10e5d11471c14863e5
SHA125d3829e7835d4ae3560ae8d33cbaae4e6f2fa83
SHA256b22328de35be299bcc03958964ae23c8236c2af89cba9f4c80e695c1f02bd89a
SHA512aa352c859ed5f3937824f218823f6a7ad0bf455221f2c341175a31753a3d0837129dbe1e87d90454f9a4e91c15cace45542225512fa80354ca98479b97341bc1
-
Filesize
42KB
MD50b3a8adfaf5cf48ae0a51ef2a84e0894
SHA1353c52134d3e2eab7ded2cbeabee59a3b97e85aa
SHA25626646e99f8342e37f740f546ad280d9d01cb1fb29c8cb78c3e849375b979238f
SHA5129c3cced5ed1ba51768dfe55970efbe9e04dd16ed6d8fa268512d4f3d7480ca5328a88baeeb23297a89bfffac9920e118b18e8be9ef8a0e3b1a4db515515cecee
-
Filesize
481B
MD5599cf513c9ba00d89437139c4c2e56ed
SHA1ecdda4694c267cf927b346c8f238a2887bc0207b
SHA256eb31ce53a476aabc67154961558119f0d5d5fa1de0bdfb754d46cc62765a5a31
SHA512db88610e1f86c363e011d89ade8370358d9cfaf6970ae9554fce1dae0c11b9de099b655643077c39087564777af82f913b4a1623fd2c80a78bbad645c7931d45
-
Filesize
208KB
MD56eb5f0eb14a858134593465054ef5e08
SHA1d464afc00d6fe510076f774f1a03ec8cb0d6f9a2
SHA256c31321aa3c93ae424493b8728a8989765c44646fd1b5724ae7b6129a509b9b7a
SHA5124c0e14bc18d38994197ef254d1759e33403b51318d9bdce03cd0798a3cdb13e35847814a64db222dfb1f6e6e5759ff80c3dedc7141792207addbbde36f83592b
-
Filesize
2.0MB
-
Filesize
412KB
-
Filesize
2.0MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB