Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/11/2024, 07:19
General
-
Target
7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe
-
Size
355KB
-
MD5
571e61844fc14ad4b7119b7b8d7f6e40
-
SHA1
5179a197b3c43e263b6fb287fa18899dcb805e7f
-
SHA256
7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7a
-
SHA512
cc3d7287fcc4d9ed87785d6b22e2999c3ba02f28e5abcdb0919ba22f745a8f51a5ed5cd7144d3cad8ca1a180c21c00a7ec9815997fca3dbb648226eba1fc41ce
-
SSDEEP
6144:73EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:YmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe"C:\Users\Admin\AppData\Local\Temp\7c2560d27ba7db46f7336c3c2c5f5585b35e2378984eef77ef7de209c5a39b7aN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5d2384b8514d55bef0497d5ac9ff41d1e
SHA1381628ea425b92c73b0d29f7b0b8701859af69c1
SHA2566b168fe721978ffe789541e99f3bfb0fc061ced954e17aa56af028f6aa23e76c
SHA51248f27df3fb6b939ccfba59cdaa13cbc8e31fab37ef53128d34ae86276a684c1c15b6ee6423b1f12c4782ef9133c698afc40fd1138059d353519b6a7dd847d1a0
-
Filesize
42KB
MD56b7f3c767a7f2d7e507adda1fde7f479
SHA13665f86872c483e5eddbac62e9054e3b33e0ca84
SHA256dd9c91fd74b4ba7584a4f8b4ab102d9e473bfd5317369a372ff5e12e87aa2dcc
SHA512f3b30f413230232c47b01ed39d3886a0d57d045b939f05dae27013983fcfddff8802937a7daab0afa521b408389b7422c696f378cebb39c6b703a7a45b58c786
-
Filesize
42KB
MD54ca58273f5e0912e9add8d2aac10753e
SHA1b4dcab000e0b81df4b4d5e7e2a9a138b85108298
SHA256d070b6de936507058571a537de483e1b81fa30087255494ad32b5c56fbdeecbf
SHA5127276d0972a0d6d2cc111d03e9c1a3b334f5982c0d4411b941dfc5df64e245a5060f6063d51edfb1a0bdab377148570d4ffa30b389196e657bb2e78cef239798e
-
Filesize
58KB
MD55e1101a159c04026c7a46a34ef4d4029
SHA142a2a3df5e5d4b2288e1c89c2019accd5d0ed53d
SHA256e6488b1ca6bafc7bc868de6ff604da98e410191a391f046b1723f9a5c60a1e1f
SHA512a2adf8ec60635c79d9a8ccea69b2a8115a1503f688667541121ad8f07369c139c3be03c5e9d283e4d9fc07dc910d0e762b63593e0410f77a7378c64fab134cd0
-
Filesize
481B
MD58e6617dec486c061ecdc162471acc4f9
SHA1c54ecd2d30e2eafdab0b5e8219310ac70f12c4a4
SHA256f1ed9caebb0c71b47042e522e5777c3ab078ced38443d72c52a66564a7d341a7
SHA5126fdc8cfeb450998075db744b9681a3674a303e65d27a593157dc57b2d4fea806e9854ac5140262720b96b7aea460ae14809693315766e3cc4a56924785f0ffef
-
Filesize
24KB
MD522d27abad19423070b1267a6f4ad470e
SHA177939764cfa98c01a4d8c2b10cadda604f5afd17
SHA256206ce3b1d04c9411910f2eb42772ac65f814e9dd0f4385ca9264fa261b700307
SHA51286ffdd2fb203ddbc063bd1415898130aea909f687ee7a5e7ade4e0c58f8bccb620605a0a507a24226c5bdd02f4c5af535968549dacb976093f34941c7c45f23f
-
Filesize
355KB
MD5164a15eae31792765e78cad4342e78ee
SHA16274c36c0f071f7bc8f8d19e853a84647d007646
SHA25686f7473a8107506b57f2f459f0e040e3f15a57492ba27876ab57dc0fd926fd16
SHA5126014e8ee81aeef8bc044568c326454ab421b44a5ac8244147355f03aea022d2e4889c2be7ca3c3a0c6be92c5f00adff6a4a7bbb93344336c30d49dcdf260e25a
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB