Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/11/2024, 23:23
General
-
Target
659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe
-
Size
375KB
-
MD5
c0a9550ada72409c9f9de8c259bef404
-
SHA1
a3637703ea7a9423cb75d6d5b0cbfb97ea465337
-
SHA256
659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519
-
SHA512
46de6ae2b96716759d5a243a2af0ed02067a7fe367701836896fd356def976fd97a4bc138bf86b641ae5aaf6435d9b3fb2d7e48765ce4f0ba997350b425e24c6
-
SSDEEP
6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:emWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe"C:\Users\Admin\AppData\Local\Temp\659e58aec07c0118c07cec7636309623fbc9e6c0e065624a70e16ab28fc18519.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ae741c04482ea8850ed85674fb45357
SHA1f1b91149f21f71f4964769f856c9511dc2775b63
SHA256f615e71a7e4708131180c6d99ce22955e7328838c7a3cd560aeb020362eb5a3d
SHA5122c10362f37b44ec674a6cc1cef7a9b54386ffd31e218b1e0d67ca791e34c8398ef78a43e758d08f842c461c5dd9052d6250050dcf10b5b2273e7dff863d708e3
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD589186cf78ac2fdee88a546e993270352
SHA1a400aef104bd70e8c51d638d4f12186826806be0
SHA2568914dc41e04b2f6ba9bf294829d602e5ba5c6d6dbb3bbff6d96856ceb066228e
SHA5129eae81725fce09ed3122e7fb46577ea4c8c90422812129168b87d7fbc47da8062075f88bf8e597217b5d8142cb0550c204d4b94ddfb8d4db47e15d4f09ba18e1
-
Filesize
61KB
MD5d2cce70b8974fc4d5d08a0995c192514
SHA16967e7b6086fb8c085ad8bf7e93d6a01ecf06906
SHA256dbb8360b3bfa34a86b64b55e865709b6d87b11069f47a79f4a3f28771fff4ee5
SHA512959cc2603d94e85ec1afaa5eaada2fb90b66af804820ebdbaa2fda809c73bcad2aaabe4797747d97a32236489f8546c3b6f03ee8b6bf1fec0304362a1f2b99df
-
Filesize
375KB
MD5b9056c5aaefaa31319dfc4f1b4b15aa9
SHA1d63e068dfc9331a77b2b3192888c471d700a3afc
SHA256cf5a45ca60a49d68e743e5f7b64f8b249ea80e44e00298fd3c3bbb6bf1a52f00
SHA512bd3410f62de2a860c3f2797df403f6be4afb6b1194590895c2fbb5c0ccf96ded6c69fc9b292ff90e8a9597043f0547b919095563ab16e8536568260ebed86864
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB