Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 23:33
General
-
Target
8aa3bc826c69ebb2d165db8f4d42426566b6addb7e7f80c0a36e34a9b685f4d9N.exe
-
Size
218KB
-
MD5
b8c86ed962a8281dc05adf241d1d9430
-
SHA1
20de3c479dd8c7ea5cbbab35955bbcfe6c0f7f0f
-
SHA256
8aa3bc826c69ebb2d165db8f4d42426566b6addb7e7f80c0a36e34a9b685f4d9
-
SHA512
b30f15456c5bc355df21f7f14559b45b6e23481c210bd9d6b6c6417a23e4d68b7407718a53817219c0655953f9765bd0e05751c642dfd3820cb9b898037798a1
-
SSDEEP
3072:Tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:L1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aa3bc826c69ebb2d165db8f4d42426566b6addb7e7f80c0a36e34a9b685f4d9N.exe"C:\Users\Admin\AppData\Local\Temp\8aa3bc826c69ebb2d165db8f4d42426566b6addb7e7f80c0a36e34a9b685f4d9N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
1KB
MD5bf4d5e830923c76a9b8d214ccb52a25e
SHA12294413b26a1ce03014931fbd2efdac2a73f4bf4
SHA2561b0c713082996b382ad773ac3b9f10693a2b0538fbb61b892301acae28ddc655
SHA5128359a04544999534eebb8715995502733a3c669160af17e8b0a783cb390b18e6612f6296aaeefab7dc4526cde9903bdb1f057a5584af3ae7eadfb2693ccb9431
-
Filesize
1KB
MD5db29b9fd447625bb81c1ebf896f69bf4
SHA17b601aa97674130e3f0e2c54e7edbb7362488075
SHA256953c43509329b450cbd235ecbff10ee86b9869ecfeea498f06abd2a5526813c8
SHA5129df9ca9bafa519247dd6faf25131073286ae2890737d6da5a530f8af2d33a50cafcf1c06caf066d85ae3ee2cc55a8751c4b17bcbe785d40adb80da35e33be442
-
Filesize
24KB
MD503000657eeeaed944f62acb510aa371e
SHA1ed72792d2ce003a7190ed3c8bdf51b134be368db
SHA25611d3af37c9117e1f2a82071a1e743b504cd0860ffb56b035c3d5c7f6a1defbbc
SHA5125f3d7ad7a7c09a050559e8c93486117eaff4488d3d1ed516e5dc9f5ca64d5f2b79a56c5de3a0342d4456f552577455d0eaa001f148d07936f302eaa9e569a4e6
-
Filesize
42KB
MD5cba2cab51c911c90865d6a4d63cb241a
SHA14ded97b071dcdaca88c0b0fbfe7cbcec2567280c
SHA2563673e3dd68becd09c73dff4950397e2c0621e1569a53566570556237579d5421
SHA5129e7617bbad0995bc60b7527eb6149fe5b0713dff4ea8f1bf917da65d84710d793656dd9613de82e12f0c3ee9c22b57c850054505fd5dc5fe70080c50a620d731
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52b763bb3119269505220dcc515278878
SHA1602aec6185a391443a4865393b13c2b0b0f469f1
SHA256200ca935783192a2d8bdbca1860b2112808d324410bd6db2b5e0b34c1a966089
SHA51281960bd7f2418de776b476c7779603ced276fa05a228e9b7efab27c3b4e62f8be1ad5a3092a8a3c1882187235942b850b418f9195418b96e58b91219757269c6
-
Filesize
1KB
MD56765b2e03fedca311ba7bb6f029e4c05
SHA1d61ca7fcfd197a18d361bf0b4e7b464b9f96f585
SHA25636274d272c8913b5bea3b58eb6f4c6a018015a56031e89005a486ddb8c5bf976
SHA5121ec904c8fb961e7eebaff83b5f2e811b046a0e23946c81a45d8d66b24377f958f3eb0e82d8123979443092f09abd6b5762d71b4adeaca6216dc500d9e564ff74
-
Filesize
61KB
MD5b31bca409375972b102df6bd1a431cbc
SHA1f30799fcc83f88fe381e58a78521358161b80f40
SHA2568b8676368c66ed37199428685b650cf716299fde820f79d8530d78bbe6357957
SHA512070156d60f87a37934b81025f587beeb69783ba38f8fe6c3f970c5fbf52e2757adfe7714a381d189502cc85ca22b81126d65f4f9e8cdd69793e13ede6ac1fa6a
-
Filesize
218KB
MD59b249a3fe3fc21c0175565689b3605d0
SHA196dbdbd16bf5bfe352841e1bd4e60e5c213dc79c
SHA2562edb62ff7e7755daadad109e1c3121bdb88968c36ab6cd320923cf643dea2904
SHA51212ff7c26c05f1cc71e132fb22ca232fa61ec94829c6ce8536db05d5f5653e22a7af158ec4c8fea496f9685b063d6c18b898bf85e427ef21291da5943c022f5c3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB