Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/11/2024, 09:34
General
-
Target
54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe
-
Size
204KB
-
MD5
da5b58e4fe4fee9869f11a077961a6a0
-
SHA1
4ded4b4595dd69197228739aab32a53618c44821
-
SHA256
54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6
-
SHA512
ed017f38c02ee32b6eb15b696fb569a9ec95b540ba5431f3186538534285c5a088d00be667d9f01b8eb30da1d7bbec54ab23f7941f0bbd62b5faa4e782a5ab8b
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:mLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe"C:\Users\Admin\AppData\Local\Temp\54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD557d8d9732d41473267e6924ba9b775b1
SHA1d916041347140990d063191f221cfd7efa263093
SHA2566a4602db66eccb1362f425875e49636c51f8fb80bdeddb77d56fff956b0aa619
SHA51202925dafe4ee229bebff2a3b135eff2c12c09282f1dd07249cddeb146ebcc245b2e53ef50e0ee2982411babbb198eb41ad58d302188c3db89703d949f908b4a8
-
Filesize
61KB
MD54220b10618bea317b8a2f0684274532c
SHA126990cfd9031d876dc64a8124f7ec50394fa29ae
SHA256caa75ebc121011709be2633479e889a6e12d1133267bbad15fd29e8053b58963
SHA5127e9eb4823da2e649e9575242559e91273292c0176fbe1498a391d71d336808c64821ae36e3f21004838e89a312c247d9c9b751070f79b657218a4f9d40facf0e
-
Filesize
42KB
MD5f9105578aeaaf5b65dcf15b8e7297b74
SHA1cc95cb17b8ab23cfba69899ef8b47dfbba3eaf2b
SHA256bdec7e3d95681e5cdf03cb7a56ea9fae8095b8bbe314c92b19571ae511fba390
SHA512cb24c8d8b8423c633c1fc05fc121e2d50b591a931090242fea838f4a1a347249e6a2c72ba9c32522c2fc98d9eaa3d803b4f66cd76babd1724ce190f828a9fb9f
-
Filesize
204KB
MD59f2a8ca47321ae122a7bbf5ca8cf6f8b
SHA1d571be67bff90668c35790068f156d0713c64a41
SHA2569c3c286f0c0e9531eca433506a5efcbc82bce7fc0b641b4fc88b0ed3a59af432
SHA5128b6c0dbfcc0282652e5f8034d6c9ebad049cff6c55e11a4e559c888216e73ae6398c3efdd7aef53cb3c0118ac2a7799e8f0151661f954d90bfd6bd5145718773
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB