Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 22:34

General

  • Target

    513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe

  • Size

    212KB

  • MD5

    935161e803404f4db2f2ee25727e1c1d

  • SHA1

    b712fc9e2b069ed2ddff46dfc01fe47cc082c0ce

  • SHA256

    513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd

  • SHA512

    5658549ed19ca9b1417871627f8c8c876f28da2c5daae05ad2b184fd95d79c1b872dc8bc799bbc36b2f2b6eab9eb46db20f385ed48a01441ed67b995bfc3ebd1

  • SSDEEP

    3072:eGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:eG/iVkO20SFgBhxtW9mG9+Umt3Ezjb

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe
    "C:\Users\Admin\AppData\Local\Temp\513095b45fbeb97af583f1f7dac0e61272aa9fac4c28811636af80c48b2180fd.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\login[3].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\61E3.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\A846.tmp

    Filesize

    24KB

    MD5

    09f557efb52b560bb0dfff50227e650f

    SHA1

    2ef590a5897509e00669fd55a87d08806b7be507

    SHA256

    8157d771c696889597b0276d783ebaedc906d17fc4793bda03758708a319a288

    SHA512

    636f40c995c471f49f911989be69db00737cd16aeb27396b9f1c4152cb37b8320a944c08a47865bb0935ad92905798c02c85821a8961c127d6cb7d7b4a3ca369

  • C:\Users\Admin\AppData\Local\Temp\A8C8.tmp

    Filesize

    1KB

    MD5

    5eb7a26f8531bc68a00ecc3de45af4ed

    SHA1

    4378fcdf55e643dc6b15a9d86a80d3adc0e0910c

    SHA256

    a95ad3efea75a3d6aa04cdaa745777e864672a277ebf35bfa138ee03b3e5ab0c

    SHA512

    0c12711df682a0c8f22af7a3671aff6f78b579900769f3b82aa0a98344983934bacacfa31b2574f5d678ff88da2406e008f45947da28c3c7796400aa970c5ac0

  • C:\Users\Admin\AppData\Local\Temp\A918.tmp

    Filesize

    41KB

    MD5

    0d73aa7d22630f8616e64747e9cc92e8

    SHA1

    0735414071fcd6b44c76ac8c7407c185a0e42883

    SHA256

    db16b6afb92e9d5f13266194c9df69225336c5f5920e4f1e635654f6215de468

    SHA512

    cae92c1ff4faf3ea4034a88b0b688e75660cbdb9f7628ac3b27f8f6268be43071263c26578b03c5a629ad6559a22abc89d5b18f7ff7b9de212870991f29f5fd9

  • C:\Users\Admin\AppData\Local\Temp\C2F1.tmp

    Filesize

    61KB

    MD5

    b4db71d86b56337d7e12a51fb6517100

    SHA1

    8df5c72f36080a678c6f40dba3055dfe9d55859d

    SHA256

    a674de0c3406c697408e1b5ac752fff29c6a05c68ba99e02a6a27a4efca03abb

    SHA512

    1125316400d75414654ce5f371b4db1ef1f42a652e314809186b25dcee9c71244ebe3c568c435ae3a2be7fa8c7d0dca94cef95ec804865d6150ba51babdabf1e

  • C:\Windows\apppatch\svchost.exe

    Filesize

    212KB

    MD5

    059458c31330aac2adc14619e3418f22

    SHA1

    1529c76a403834b03a726cd90f3c003a616104ec

    SHA256

    fd57b685c4d192c8ace5ba54a6e1e19c6e8ed9590f92e3e0f7166ffb313273db

    SHA512

    d5ae57ba2d868d6d38eb4050fb79cee6044e378c99063a9c8e918b06682063dcf8ef075e8f739d1d36b57774e3654c5e1d05c92b293b05b807016c55f9d71139

  • memory/2976-58-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-22-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-19-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2976-20-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-24-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-54-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-25-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-38-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-79-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-53-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-77-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-76-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-75-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-74-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-73-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-12-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2976-72-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-71-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-70-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-69-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-55-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-67-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-17-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2976-66-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-65-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-64-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-63-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-62-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-61-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-60-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-59-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-18-0x0000000003140000-0x00000000031E8000-memory.dmp

    Filesize

    672KB

  • memory/2976-57-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-56-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-16-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2976-33-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-78-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-52-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-51-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-50-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-48-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-47-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-46-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-45-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-44-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-43-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-41-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-40-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-39-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-37-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-36-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-35-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-34-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-32-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-31-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-30-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-29-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-68-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-28-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-27-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-26-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-49-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/2976-42-0x00000000032F0000-0x00000000033A6000-memory.dmp

    Filesize

    728KB

  • memory/4748-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4748-0-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/4748-1-0x0000000002390000-0x00000000023E1000-memory.dmp

    Filesize

    324KB

  • memory/4748-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4748-14-0x0000000002390000-0x00000000023E1000-memory.dmp

    Filesize

    324KB

  • memory/4748-13-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB