Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/11/2024, 03:18
General
-
Target
c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe
-
Size
1.9MB
-
MD5
7d79f3b0e2deb7c588a149d657e6e2a0
-
SHA1
190361a8bf159319574ac72572d20f744152fa91
-
SHA256
c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885a
-
SHA512
f2a8d68ec924e2699dd05134120bdc850e593f73a6c477029c20e31a7c00e82a8f8f0a1cc6e2a2473c11b3c3bfc0204c47b7369ae64196f181ffa0e25ed9bbd1
-
SSDEEP
49152:5/+1R7/+1R7/+1Ra/+1R7/+1R7/+1Ra/+1R7/+1R7/+1RY:5/a/a/X/a/a/X/a/a/1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e19235b024543ea07fe53acf30c6ecf5
SHA1b091bd3d4001d142f2da852f204d8bf492c61d9d
SHA25679f210a2bedd286a49afcbd9db89b9724d6eeb5aa8d80b6c8e2e575776028809
SHA512934a3cdfb25fe2236be0cb36df282a2dac04c7f119d7fb54615c73f4e3993538f48674b4879b8dd1fa561de121ea510bc36bfb39b52e16ee390944ee37d7fae7
-
Filesize
1KB
MD52db42c5944e939b484ce90cc6d50afff
SHA10d70aa8dfe7f38cbfb16977988c1a155bfe08084
SHA25629700f7423a47d45d9862801e3be8a40eabc21f8e89048e55680755f3bd432a5
SHA51212cb9a9e01de6ab06f77f93165f68460a1e9380b338ab393324cd03583c8c0396ff06cae4f3a3f72be49dc517912d101418883c5798de539f777037be872cb2c
-
Filesize
58KB
MD51928e9f1312d984448527e13bf5f5e56
SHA1be281f932d8c935d878ca9ad8a471b4231ffa2fc
SHA256289f54489ceae21939761b9b0130635c4aa56a3b026589c71c139983e61cc3cb
SHA51269ce02bb028b7e129c8c6daf82790c61b18f0d59463921d7dd6149bc73bb2a4addd83ba1230690a3e1ac34182215c656ff49c8dc6ad66466b3ed958fb15de9a3
-
Filesize
42KB
MD5359f80cc194336182523cdce3b3910cf
SHA1559f28a22a638d72ffe2ba24eada742c1ee60cca
SHA256faa49fecd5493db3d9baa51382fce65ece27791c453ba965d7989d2e592969fb
SHA512f08c4f323a1cd76bf89e74d8978992d3f50f8112efac86ac74df01a75adc4351bf63201dc1b1a221a8b2d1d2f5802626344a40602fc8044e559a9b1f30580c2c
-
Filesize
1.9MB
MD5d1b068a8fed31676e33f9a05e4c27e9a
SHA1074ef77f9b1295ca2f64797e96bc2b0bf8dbc3ce
SHA2566c1bf9615d3e6589d5c3de2d61381281538aca75749e3ea3085e60505ad9b80e
SHA512efd3bfd5987cc56023eeb89106ec958d31dabc1cd745771e750d261f1c995d248101f0afa0f141aa92cbd5d1b21f00ddea01e69b56b13aea655d5d501c5c68df
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB