Analysis
-
max time kernel
115s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/11/2024, 12:53
General
-
Target
54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe
-
Size
204KB
-
MD5
c5593299cda2e604538500d236fa4725
-
SHA1
89e63490e35bd7848fd58a388a443640ee6cbedc
-
SHA256
c1d9071ab5ed32e3f860f2270fa32e607c86c330d3df2e1ff256883b6c9235ec
-
SHA512
80d240085b4263f2480fb68bffce0adb071cadfb44a88201a1abbbf597447cb31a5cfc4732cbf64b67546da6626b46679366faad51a78e7d056ea3ab80e38953
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:mLexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe"C:\Users\Admin\AppData\Local\Temp\54bbe78942bbf757fd3fa5dbdb068a066e11902426aae05707d74c0f9fd57fb6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a83195768fbf9b3321f79372f90dae1
SHA1f63686bb9c72a98b15ddb0d8cc336f71ad7906c7
SHA2562b007e8a031bd4da68fd19b25cadd0cc61d617a37986ecd0978423bcb894b646
SHA5120456c729fc9a5db99128a8df8f394563da117d2022c3042ea77a3e22faccfd019c4c919053299b50d16916b6a344030a107a2b9d2d0babf171f03c4751a4a05d
-
Filesize
61KB
MD5a641c7deeb2ad913e10b72daa9d7c9d4
SHA12b7c7134446319e01702ba4ee6978ec63fd86307
SHA256cc186c757f5f9f12db2624af395e93fddf3accd20533bfb43247f4bd36412124
SHA512bbcd211d04910153aae5d72104a4bdd7dd5b446d847022c5c204f5b494660cbaed3f76f45246fd7df40ef8a786a2211b21a92e908cb9ea71fbf153f564b14d68
-
Filesize
42KB
MD5a563aa28f011dc50d569a87c220d3fcf
SHA121fb86a5977fa03c4ad74b453d65e3d4f7b8d0b7
SHA25618701d9820c577f7006dac9761f28224650562542d746ba8bf996d331107f541
SHA512879456c8cda338e4e333c662ab5c34db0aab4db3be0ba2b37ececef1a0fc7090bed7bbca9c135a5c39fcb3a04df28cd7fa7ee4bd32f018b6bc777e320223dc64
-
Filesize
204KB
MD551e10658f4ef62c6c963e8fe0488d2ff
SHA15e8e8b62390be37cecdf30e8640ed34529d75411
SHA256c12ea2b681f5086380c6f0e98cf4d1fd70cc59aa05f3461aff82e2dfe96a739f
SHA512ad70bca50fb77536b1c93d62f9f16aca2947b9b6d539934701b13a68e3b3814d14528516fc031c6d128837298c0a2499a816728d735b0ac64afec574e6c3a451
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB