Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/11/2024, 05:27
General
-
Target
e888b20f42850e13f1afb1cef9f637da90e20278e353d8bbfeaac6e35814297e.exe
-
Size
218KB
-
MD5
2f182a6ec30f42594e2d3d903979a37a
-
SHA1
f07c485288b418ff9a7c67309c7c2739df7fe908
-
SHA256
e888b20f42850e13f1afb1cef9f637da90e20278e353d8bbfeaac6e35814297e
-
SHA512
8eca1791304914015ab3cbb62b7a1694f5c95d0d02fa51131abf87b778e7eae5f847ce442130709d71c5c3077285e80c491892e1e08b0fcadd7a6d73d0d50330
-
SSDEEP
3072:vvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:H1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e888b20f42850e13f1afb1cef9f637da90e20278e353d8bbfeaac6e35814297e.exe"C:\Users\Admin\AppData\Local\Temp\e888b20f42850e13f1afb1cef9f637da90e20278e353d8bbfeaac6e35814297e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52d9a579d8b10f43311dd15eb2a6ca0d8
SHA16ffb17551cab0a2af9752d8fda9e8343a0cf6794
SHA25688d8dd45e053af962402efa244322f2e737842a2052bdf4c08551f08048074db
SHA5124316954fcef2a2b89d953d027efa8218fa5f4421ce93d7362a362b7e30af183dd9c1459392a21578f856ed1b85cbc0b4f27c9aba2741da54a2d0dc1e41b960d4
-
Filesize
42KB
MD5166105923cf6cd52cbd5ec2f700bab22
SHA1da6cab15c3d66fc4789d5d034d233270da1b8522
SHA2565752914b9180ace393fd8f0fac61733db960d9f942dea58245530188bf2e3905
SHA512395d09e74ae17135941814338e74d55d590dd522810a4dac03a6608f57c090812b5f5167d4d993b38740609ddf34ec0d17815536b30a430008763fdd906d9b56
-
Filesize
42KB
MD57332d6457ded3b766718ef80a456f37f
SHA1e9e4c13b3f5cb8c6b8c35d1f932077e7f4a25ef1
SHA256b6fca28fc2c314f3cb28384e28cf38209ccc5a369abdff85dbefa55ef159ef8e
SHA512a71eea99249ef5d450ab67830d9cc560f07ccb09973b127dd133249828fcff6362efe7c568e9a705f99eb6f7f1bd4f12063b20755eaae8edf5da7922ada85c5d
-
Filesize
1KB
MD5bc83d86ffc4b0d4eda37b24b5777a92c
SHA1c57062ab976a0fc6b0ad462cf1ebfafdd8878590
SHA25663462cd9e450511b5da8c6dc580f85a0451ae66fe3f5fb3edb29b31c8c06fcd6
SHA512e33fb7a460335f3f53fcdf2d3fb925e5f02e578d2dc0abfafcef7724574e35654da6dbce1a5923e8b41636bd36066bae7f0742156275a10715c3445025a93556
-
Filesize
218KB
MD5c5037be0e45294b3c68353055e5d579d
SHA1a12118ccc33e3d4af4455625aa8737ff62940b42
SHA2560f0ebf94959b40d1cdea40778cb7ce965582c245e2eba38c8d84ceeb000fb50a
SHA5125ed00a11e8257f7b22747634ff968709f7e374bde08c6ce2741e7cb87dc52b79e79e9dc14d4ed323e668f6c5cd59873ed88a9052f21c1ba98f340b72db8328a8
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB