Analysis
-
max time kernel
107s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/11/2024, 14:12
General
-
Target
b043e3e0d2f9b4879ebfb607d583d1554da7cd4b1c5cb1aa788d82df37c0694eN.exe
-
Size
686KB
-
MD5
c6058ed5ad3a9550c18b8c76ca5d0500
-
SHA1
1467597b0fd28ee307fdc935d27f4d4f7cf6fa93
-
SHA256
b043e3e0d2f9b4879ebfb607d583d1554da7cd4b1c5cb1aa788d82df37c0694e
-
SHA512
1fa810c344a592853f4adc1a10d34684f90b6bfb21343ec56a1c77b50df427d3f2cb40f66a921a649a4b8a9e35e40486c1ae4fbd448ea69b9d189189b5953639
-
SSDEEP
12288:7mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgp:7mUNJyJqb1FcMap2ATT5itjCYZ3DSo
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b043e3e0d2f9b4879ebfb607d583d1554da7cd4b1c5cb1aa788d82df37c0694eN.exe"C:\Users\Admin\AppData\Local\Temp\b043e3e0d2f9b4879ebfb607d583d1554da7cd4b1c5cb1aa788d82df37c0694eN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fb009e9dad4233d04b898cbc70bbf8f5
SHA19e9fde29354b1e95ea76a7f8aab3db30e4d8b9c5
SHA25645672eae03b14ef8c2d4651dd130255ae39f89f68edc9cf9f05ace318f7c2d2d
SHA512a6dbbcc255f16f86244020fbbb53c3ccacc239fe3ddce90a96e1aa951c0ca487d2ac55e9e179117f458cbd3a43fb52f3ab68b98191adede7aa557340582d0b43
-
Filesize
61KB
MD5c8a002c8c94aa08345360809fb1fb6aa
SHA1d4303c8c35fc7f782c3e785cf9b192d60cb4eb27
SHA2564ccc93df25f03696cd6d3fa436b8fd3ca553771406b68d6e84b0462c06202948
SHA512d3c469acf29e2d0a0f760800a763aa2620c3eb9ad070e3ab5a743a1ac7df47707f8a45f5af8bbd765771b9fe1d2d141b2a73073e1ed93f73c1840388fd62c8d5
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD53193d7865e19cc1971bf95223f7ed928
SHA1c0e5ef8e23d324f94dfc915a0893da971190ac67
SHA256c05ec6dd916727af1214f0ad7cd4a5da39d449fa6ccd54ed25bb565a4e2595d9
SHA5121264c400a42ce65e1f9962a6bbd11f91b8c45f2bcd28dfbee97d8c7325ffbcea92357db7d5ac93755a5021c881c5ce181aef222a76282c7e97224e006841702c
-
Filesize
42KB
MD57e2cad2e23966752549f603325a73caa
SHA1e70f9b7649c435315ae094df33a17206201cfada
SHA2561354c7a6572f22a413d6f92bb843fe089087c1ed02e2883097c582a463f00967
SHA5128a6caaab01b01d1197f0cf198d8c84819deac42a0561279164aa1cddf0f633abc899d78f4e56e2b5fc8353055d6fa77d6b4c400b6c67f1193711d475213265f9
-
Filesize
1KB
MD5a0dbab539936cfe0aa2aa8a3c356ed42
SHA10b1171610dfce969f44532f380ecfeef41c02a6e
SHA256cd8932946e0f66cfeeccaffb4dcb31de5052f219da28abef76b899c1c9ae1712
SHA5128faae5d15055e60daef9fd780bd351e32a9fd95228b73e4b14cb5a2ff24b4a5daf8da73ac0367160f8c3facdbd956f2241037a81f7ef2335d896a1c8d6b8b2f5
-
Filesize
686KB
MD54500b9a7011e5115428ae59052c816c1
SHA17f6b28706a40a228ab796c157be2b98d5c99ffc5
SHA2566cf15b88d972884fec775459ce7ec7c66a9dadb5535d945d629a9f596e97472e
SHA5129105e2b0ee46d3e191cd238e5ff410cc892bd771b743bec7b956a7691a286bc89afde58cb68f7dc2214923f25e7287afb20f147585f09409a5dd5288b21852c0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB