Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08/11/2024, 04:02
General
-
Target
c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe
-
Size
212KB
-
MD5
57e40a37e55f737b61a5693dd90329de
-
SHA1
2f80a18b3441a5af6ec79c7e707386d9ea3a5ddc
-
SHA256
c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e
-
SHA512
5b9721fbd78328a074ac7f1314977744e01395f3492067b974c7886e879461e3e53d7c261f3c86fb3f1fe95fe6c1935f438ed91fe76c387d1a0bbc9d5e8710fc
-
SSDEEP
3072:AGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:AG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe"C:\Users\Admin\AppData\Local\Temp\c6e023348ada0a808ac7123c451c28b15536cf0eaec849883f80e9f17d51bd6e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD5d62f9ebbdc909443b601d6f093f9acbb
SHA19cd6c83f425a92bb846bdf4393097b50305d591c
SHA2566a23469b08c6c7e25104f299f47060027ff62b07a378f838398930aec1036f04
SHA512cee608c9948c2d3117aca8eb5f5e12ba9717e4799bd11d5400d8d6612a8a184563a1616a244606b36def40f844ef17151bdc39b80824170fc170d8b0cece869c
-
Filesize
481B
MD52c4e5688347ff0cee50a7508c7aed7b7
SHA16330d6744e138aab9dca1f1515d62ad42028ee8f
SHA2564518e3918c80e7ecb0753d247a7909ce91ca80d480ee3a0c3f6f0f2f7df638f8
SHA512e234d0c7e13178fb6b0ba16defc209335bf646ccc87227b3c1890a73c2a6ad406befe81672dd320d28f4ce433e1fbf826715d745eb0e41401cdeda2cf78f66dc
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
57KB
MD5152f8eaed0872db78d2d46940547974a
SHA10f6051d7597a5ea2ca444b1f4758272ec0d08521
SHA256632438ecb69c878c76244450009233663f507e4712fe4a070a2648f9e3f1b354
SHA512a8a4a75bec12f4b99d816824c63f30810ec364af9f0024195126d464ee32ccbf48d00315acdc6ac753176e7aa8c1837e1bac6ba9ec2f002d816a93e6ccac277a
-
Filesize
42KB
MD5e3b47811851f4f77ed74f11d6095d692
SHA195a283742322635dfd0d619afd493a59fb4e4960
SHA2569c1e9c4e25b2186f9a789289c878aaafe5de1b453dc8e4338ec75ad638c84af5
SHA51236869a585f366906902ffc9a29080c9d73acdbeb53339c5332234739242f1033a84b1811a56e58a1167f9d897ec677838a1c5ff71428e64cf85f1136d3f673a1
-
Filesize
42KB
MD5f34ed253b3500f7603ba7502fce1934d
SHA177ac9047c83ae1e704bbddaace90c998734a537f
SHA25675ecd6ed1a7b34733b201a8e40054d937e9f5508e6b4aba7880a84339c8248b5
SHA51290262d975fc3082d2ec27412200d2bdeed679c39279f91e2c701912082659b91228eb095d86ffbed5bf6f6de853c35bfa64e3ddab9f668a36e9c3ed9e061b6db
-
Filesize
212KB
MD5e2dc7e25a06f8f16879e595a6c194c0c
SHA1cd8d813c19a0da2ef3574a2d0522cdae9a1eff54
SHA2560921d3b65d4b7e77ef0a78cb651a71632672f95e57506cfe6be065f0cd748f32
SHA5128f9b21a3c5431cadab04ca328df905ba73af97d119c8734734de5c1b69ecfaea21c26bdaee7d35c74949565f02d0a7326a660f2ac08d1080e9c21b9f1522842e
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB