Analysis
-
max time kernel
113s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 09:59
General
-
Target
1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe
-
Size
204KB
-
MD5
1d6e99b3003b3d3e770b864db99400a0
-
SHA1
f7563dd64e43cdbae2d32c361f31c2d4c5a53a8d
-
SHA256
1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4
-
SHA512
a31d620314a9eef6b37021cf31f5efbaa2c64abd3982dc563b90b6cfa027d75b3fa17910285bc2338fd99c41b00b4715639a54d8ab4c915e990c97227ce34d65
-
SSDEEP
3072:F5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:FLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe"C:\Users\Admin\AppData\Local\Temp\1352a6f715bf88bd5eddb886916a4c0ebc056f29241db67e5f5da3c9eb94b8a4N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD508dd6698e888e30e163aed879dce8011
SHA1046eb51cd95bed5ab507c00c571c53d54bafd1cd
SHA25699e1bb8bb6623b07876ce6c3e0bb94fde6ca8a7d423be5a03023184c3285ed66
SHA512186cd361e8b2367fe0711a9632a8898d2f26d611cb6079ede05402896dfb91f3cf3a41eebd7d2a2254f326f65b2157dbbabb15cab966f764ec378f9dfaae9a52
-
Filesize
204KB
MD5804d41b85f7b76aa16e67522de52cf18
SHA1c1e7caf3e085e1acc21c076bbaa860f31d82e9ee
SHA2562458282585ee0621e08c71f45e2cdc7d4918db3364c8146eca088cd411add3eb
SHA51274bed1b7cea3c8be4e81a98e1ce44301a033e05bf1a6fe595e2dce348fc13d82203c0631dc235482ee72db912a898648040635696ee44ce48de5c82619b69b42
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB