Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/11/2024, 01:46
General
-
Target
a01d2dc5c6b9102ebd980dfa098ee3570deb263c0b9de8ee286352f21f058692.exe
-
Size
355KB
-
MD5
7c23aa408c7f3d69d4e2cd9cb761c391
-
SHA1
f388c851f53c44756fab44dfeb714f04bbc9648e
-
SHA256
a01d2dc5c6b9102ebd980dfa098ee3570deb263c0b9de8ee286352f21f058692
-
SHA512
4d6cf62aafc615ea78027ac7dc5e3def3392d0bab4f0997c8ea5416730e34b546abcc1b6e161d4b11b704aabbe0e89af9b85bea5a102be8992e42dfcd661a961
-
SSDEEP
6144:KgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:MmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01d2dc5c6b9102ebd980dfa098ee3570deb263c0b9de8ee286352f21f058692.exe"C:\Users\Admin\AppData\Local\Temp\a01d2dc5c6b9102ebd980dfa098ee3570deb263c0b9de8ee286352f21f058692.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD50d4403cd7f776518147327f9b6954dd4
SHA16f6cc94b703313845591d10290f2d13e903cea42
SHA256d03be3878518512922116008c32da773d8b2ec158e7edf254459d38cedf612dc
SHA5123bfb7bc71db4a491ff095dc96847707a94f564f7a6e14b7ce9cf30298350fbf921a8988184c2f1d2cf3097962410bbae9ae7e505a1300c1574f4538e7827959c
-
Filesize
61KB
MD5692097a9f55466019a2d9f87a26a1fff
SHA1086737690c97bec6949c6e184914466e4f3d1c18
SHA256d4a27ba11a8e52c881331e9555689e6d15f5a37dd2c6acac11485a66d5b1eeba
SHA51244b354d04525fd8f7826284c711c71a32a0bfc2b3397863fa4364b8a78aa8313ccc3bd5ed08170e313e30e368440c3a46b666600a3a20d59ecc9ef566c139bfc
-
Filesize
1KB
MD50ba768dcab8d6ef1c7ca280f5c45c827
SHA1e0545211a2c5a4e9edb6ee6c9150291729bf8e82
SHA256bcfb65f34fc597104ad9548cfadf8469a84439b0cd79a7c59057b219be44fa9c
SHA51275d7cc26cf0ecf1055efd0d7549db88d3b65fde161acd2fcf07f026ea35e29fd84122f7633c97b662bc47df61f075b4fc16e11be8620c407e0f3c6509d2c657b
-
Filesize
42KB
MD5d4ac102819663b0e8c9bf4df2033a164
SHA10003b1ece1636a1a09069592a245bd4ee87f38a1
SHA256b920acf83f3d881dfc19e89912136ee353e558a5c35bc535f3784dc72e522b62
SHA5120615572c15241a9a155e79a3bfd116d3ef690c8b3ef1cc04dff19b053449b887f41d77af7f1b21323b00ba8080d6cb676fd208c2915979b9606158ee4ba853b5
-
Filesize
355KB
MD54c0478ae21b383746cda544e074234a0
SHA141295e75a51e01d2c8eb73c554313371b4d38325
SHA256903abd9de11901c3c2013ea218813e33b1396b0229224011e85b76d2b5d4aeb9
SHA512055f57f3474e14d7af7a2eb0ac0d456be73c0d369bffc6c59dde236d7e7baf648583f54600faa9462d1bf42f0f5f0b8814309e1093bf33d838cf57f0089d4f77
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB