Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 00:05
General
-
Target
fc0e9801f3aa423a0b304e37cd10a556ee36aea69b57a077b1f7a7932f5805bf.exe
-
Size
202KB
-
MD5
f6757c263ca203b9b476404bc7d91bc0
-
SHA1
2c480b9fe44ed2b6ff463ac4c652249be2b10ff7
-
SHA256
fc0e9801f3aa423a0b304e37cd10a556ee36aea69b57a077b1f7a7932f5805bf
-
SHA512
2923bda27d2755abd84c94fb49d83661c55cafcd5abd742fbbee11775388cf6ef38fa2d2cad2b68bc900980612ad116e9b556ea6b8800f412a12eacd547a364d
-
SSDEEP
3072:X8nh2Hrp3Tlp+soN3BY2ZBHetwcyf1w5DYRZPQaQrhu8ihDNugrBVgc8gbmT2PcF:Mnw9lEs3hhyaubQTkhbrBVL8gbmT2Pc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc0e9801f3aa423a0b304e37cd10a556ee36aea69b57a077b1f7a7932f5805bf.exe"C:\Users\Admin\AppData\Local\Temp\fc0e9801f3aa423a0b304e37cd10a556ee36aea69b57a077b1f7a7932f5805bf.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5b34308ba54b6efd24874cb1718afd8e5
SHA1cd5afb540a30003157b61dc5cfea0151c3d328ed
SHA2567c64f1167887ad1ef6cc3434206de9af8f70ccd73177b9aecb065f63d67f310d
SHA512b6e0ea339a963b30bcb075329ddb8d3b194cd47f683a3415793d408764c1a0269b50aa00ddd0b1a434304df72532133b45451e1d2209c25dfd898d5e197a6690
-
Filesize
1KB
MD58859cd0ef5375d103f238e599ae8485c
SHA12a397ebf9e766f905e2394a599b3a9d99f0857fe
SHA25634aa0a4e290baf50519a8448178601f0963acafeaa68e1b0933b2375702ff047
SHA512759a001cb5770720afa81b928ea64f1791ccde601a493840992415af0eb32c9da164e8a94c51fbc9e3721d66af29bcf980d3e50198d23b1928b045a3b0287b0f
-
Filesize
42KB
MD5ed360cc1540e48d726e07b5a0f7e2d22
SHA19f12e1669b5a4923f1ae1bf99ec088c63f88a364
SHA256546bf3a5d88a6c33a77d96ebc4a257dfe4f5fc0bd428ae8433e3ca682481b6b6
SHA51260d1dd9daabc63f1a1c7d614099851788c0e5ef27d446353dcf141fa234166f2a8f48930510653ef106a9aab402f4c4d4fd75075b1ddf6429c30d51e3a1fac18
-
Filesize
202KB
MD565f662dce8aaa68ba398170e9aa1cfe1
SHA1667dc8c53cc69c69bc9763c33bf0aaa91c94d135
SHA256ae7dc948441484b20c1ce641dc81b3efb5b8e18067b77e1d39380bd1910edd38
SHA512cdf1ba7ee5aee3b8e47e5c7cfd7fdad2c18257ded3c61cbc7fbafab3e1af37fee559a87a1fc7fe8fdaacc7adf2bee3b87136c4aad2bb23708026ef2a365a665c
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB