Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/11/2024, 22:48
General
-
Target
e4e65b001d63e7be86035e0e88b4edda0d410805250b1fa72978c923f871c2fa.exe
-
Size
686KB
-
MD5
883f5bf988e28b457a851e038e653b48
-
SHA1
613bed64177364515e61d12dc6075099e1de6a44
-
SHA256
e4e65b001d63e7be86035e0e88b4edda0d410805250b1fa72978c923f871c2fa
-
SHA512
2c0df086c20674ede6b4a521984443b098e1ef8770b3c5afbb28f9ca389c4fa985fba9c3e162b016f30d323c890e1cb64c1c4ef3bb6d0bbbc775741cebe10d39
-
SSDEEP
12288:7mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:7mUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4e65b001d63e7be86035e0e88b4edda0d410805250b1fa72978c923f871c2fa.exe"C:\Users\Admin\AppData\Local\Temp\e4e65b001d63e7be86035e0e88b4edda0d410805250b1fa72978c923f871c2fa.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5335a5585d1acabd1893186b713dfd70f
SHA112af9b48058674f073685de018424fcbf197d6d3
SHA256575e98bde75f3135b2970f75115f22c686982f6690b7aacf6b427d0d816d6057
SHA512d17cf35dd6acc348055e9f3f8e5fa9b9bcc5d9e15d4e2c96fb09313234905ee63abac51f2f13a3a537816c72800991ddfc26fb7e6095a59b3a74bb70a0d136e1
-
Filesize
1KB
MD5a77524046760ac0a2f98845c0dfdaa10
SHA1a371917623c6e53a5a2482dd8a4582df12593e5d
SHA256a7df45931debc9df7445004e53c9710ef7ab2fea702697c25e0be65ab6ecc468
SHA512a5cadf0d2a0c7e58795ea6d880a7a3aed5aea889c39aede72969aac828c181d4ace6db3e7a717656ce505675fa426fa3cec9c8bec55d012a381b454ce41e5a78
-
Filesize
24KB
MD5d481e45465a32f7eee1d96cd44c0fa1e
SHA1f00b532505ed12c5b75cc614e60b8b01a8f333b6
SHA256b564a87e9465c10122cbc758d1323b2771d4c64d12d467094fb631ff93a04cef
SHA5124d769019e438c01c76de7e5689d27cc231fdba39c0ccbd1debc2b18700dc76ea07686f5c120030996d8fa435412d5cee63c7b994f4706296e96f8de98470700a
-
Filesize
686KB
MD53b69460597b96aba90ce62e5435d407d
SHA1453360a19dfe07c7358fafdf3891a2fa92f53579
SHA256e8e250141ee14cef2b227612193c9c1134ea8762cc5d653e7dbba6c4fbcde3b1
SHA512ea1dae46637aa5b50de6324b9798866d05f84e0469dc444930a9a4b81d36d77b3bea8fcb9d27334250b4de2db1a986e9dbf52287d3b077a97557e907da5d4dda
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB