Analysis
-
max time kernel
104s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/11/2024, 13:46
General
-
Target
e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe
-
Size
355KB
-
MD5
da816f2170660c83e6e3f96b8bbfb040
-
SHA1
283427ef4e743071a1ea177a715bacb9ef46061f
-
SHA256
e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e
-
SHA512
3634a6412d618efafd87403c1c2a9ce8d0918886112bfb545fbdfa02dac0045b16432dec37ee377858aa3a3ea2b2969cb37548828eede73a76c8cb60a5fde922
-
SSDEEP
6144:VgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eid:TmWhND9yJz+b1FcMLmp2ATTSsdd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe"C:\Users\Admin\AppData\Local\Temp\e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD55b64b1866875749d1e2b876426217503
SHA10141f18c6448cbc324ad2f19c4220766f922c5a2
SHA25633f2bed0a007e4444e087a5fb57f95e886ac2c6b79d674bad9339ff14725e1a7
SHA512c7a4477eef1c6ef804f7897fca9516b980cacbc1d81e35f064e72bffcb4c6251d3501dc61b4f04fb14238c46bae5a3b43fae34630c2d258f110c1e733170ac3f
-
Filesize
1KB
MD5d816e1517cfe588a4e8cace6b8e6d726
SHA1b6c58ea8aebb9c9a8296ef31422ee3f0d00be3fa
SHA256aa3858d8cdda148d0ac1fb9cb51a6563ec694d867f9c3f4f563db27744b84642
SHA51232bf63c527d86307121cda04766c8f7efb988c76d675d35783ee5ab2c1e51928131b8fc52fd8e8c349ac506f6b9bc07ee1516d38126c140efd27b23d8b052fcd
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD58ea53d3a1376f1fecd1b1d0ab4ca62bb
SHA1ae1090d39b1d0043b362cfe991436a718a3d870e
SHA256f31f1510e660852830fc327cc9816349fd5e4549f67afac3b079be583e6db23d
SHA51216301a825080fef30008c2f21513eb9de6af76fb4f861de2a8e35234a56cf8445afce0b1206a607788ba5df3ee0cb75d4ad50c8df07e36e1c4d62213645dac9f
-
Filesize
42KB
MD5f03751c190c2aeec7a8706cdcfd915da
SHA188b4714d760f5705f030b9fbbd9e6cf453755fb2
SHA2565622ad810605781398638b25895c4074feab4d358c9c6ca11ced1800a897d833
SHA5128dfdd2317c6a8b8b7f89cc9c293217e0784d164321399ecd729b89dab541b52372d47ff0d75f864754f10d1835d99cdf0f8ba2a37bccece74ed94f3fedb28960
-
Filesize
61KB
MD5cb1cf25954c81cddeeb9de4498533e9d
SHA1a5c9661b34f83c299bd84b8bebf25fa659ddaf0d
SHA25623ae29065cb2d3146c6c73c5f17972ee23cc90352109760b4ce59397dd3880a9
SHA51283d51dbbaba40ceda76567869e0281c275c40a7fab12a60ccc5655825e6ccc533dcb0d391890519a4890ae0ab05e8c675d9e0fff983190a44cc6ee9b3fb9aad8
-
Filesize
355KB
MD58035089a24e84a61efc9c7c79d3fcd9d
SHA1dbb0489d3b8838072e153613f6492a82bbcb5e01
SHA256e087d55f29c6c8e3f75dc3cd2a4bff2842417a22c956ca6df8935f6bfc7fd2f0
SHA512875b1d8cf3bd395cb86551d3af57ab82ea554d150cc342e13305404a32f7cda305f1cd5084268105b4d18d2baeb61c350c14d4a6d72d225d37e122644c2b66aa
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB