Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/11/2024, 05:40
General
-
Target
c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe
-
Size
1.9MB
-
MD5
1065668ef722c801ac71dd3bba7f5c43
-
SHA1
3fa25ff25e02ffb21d5ab90e8d1e85cd265930fc
-
SHA256
90aa3af284e6eee41fe7129fc288550ec8354eadb9dbbcb040e90484abc293cd
-
SHA512
b511a017ac8a3ab7ab9c0ef2d8838dd99f7da694855fe4deeb0dd465c2ee1185fdd6743665415edeae753cbc1c882389c5dc989cc69486bc4ed51ad633172d2a
-
SSDEEP
49152:5/+1R7/+1R7/+1Ra/+1R7/+1R7/+1Ra/+1R7/+1R7/+1RG:5/a/a/X/a/a/X/a/a/D
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"C:\Users\Admin\AppData\Local\Temp\c69cb26a84a2fb795ffe8062e9fa3782cff190b46ac9ca0a65d09c77ec51885aN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
99KB
MD50c2216f65ba44bc17552bcf02c804305
SHA147255ad458d06de9b822d18b9cf3be69bad74dbf
SHA256513754104a6f1417cffdf4a97b5a6f46ba59c879f9ed15e72691997fe17ae834
SHA512ba098b7a78b2ed46844badaf26e4bed3484d4d9d29a6e4bfbde66d3cc213c9783a54e9b0105416ecb8a85ac7f63e55849ea770e62c9739f54ccd068c7498531f
-
Filesize
99KB
MD537fa7ded09a3757ec7e09c554ab31a98
SHA1c9167a60b0773a95dec28e41360422fc103b32db
SHA256a51cc70b03f6a10305adb32f76c7503909877f50959ca43f58d35e6a8cb41a35
SHA512458aa89ec5cce60a284aca7563b6f258c5e91253844e4e7b29cbc9d883e8b94446f086ef959327db5ed5a51d4394ba81dad942d4e573c51f39c42277047cad04
-
Filesize
58KB
MD5c7f69ca7898c67d3a569d181e47582f5
SHA1335a82ab4af5b788304efd1e32d49ce80c550392
SHA2560a1cd89f3db6cdcbdb6145105007301827acc59cbaff2e2d9ded849594a4abd6
SHA512fecfa3cf0f12ade4d1bf9de2b025a0f14842c85e4622b88fa71536a040e5fb286bd22e3e22b759f64da0b02ec4c6c93050b12ef386c1420392f0b51c40903b0d
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1.9MB
MD530bb6a6edef084611ee99a9c82cae990
SHA141540495d9e37ca8af22536e77abc8767c63865d
SHA25601fefb99202a568dfc5e4a79a6909f08f2f67d03f27d784710a8ba7e6f6868dc
SHA512278015fef76497d19b7ff1f1a2fe8dc575c9e51f7b8b72eb0bcbd3aae6529436766002db631eebbd97395e8ebbf824e30d7a8214c76bc28154146f2b85af87c4
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB