Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/11/2024, 13:51
General
-
Target
e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe
-
Size
355KB
-
MD5
da816f2170660c83e6e3f96b8bbfb040
-
SHA1
283427ef4e743071a1ea177a715bacb9ef46061f
-
SHA256
e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e
-
SHA512
3634a6412d618efafd87403c1c2a9ce8d0918886112bfb545fbdfa02dac0045b16432dec37ee377858aa3a3ea2b2969cb37548828eede73a76c8cb60a5fde922
-
SSDEEP
6144:VgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eid:TmWhND9yJz+b1FcMLmp2ATTSsdd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe"C:\Users\Admin\AppData\Local\Temp\e18af43add9ee2e1d5722af6b1a5ecc36e25757074137c50f062c8a4251ee71e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD561d1f0f45e85a84a8b012e95b527c99c
SHA19399f643f83130819f9b2ae73a67313e164d4788
SHA256db8bd7a3e8857bbf617d9e5e1f73b7ae8a741b00fa4508695392e5e74f5ba26a
SHA51287e796eda6af08bddac81b73ced9ee19511e129f4bca4a7f24e6d0865616de7d8e853b82a622d828d452ca2af79ca20b08fce269a9882599aae76419052322fc
-
Filesize
24KB
MD5c7ecca4274c09f31b9393b4e30c5ff19
SHA1ec09722004f398c5b10ccd01fbb70ee39e836538
SHA256b9f2600459cb10ac6031656228509f1e1dd8b7ad360d1eac7df5db72a2b76926
SHA51259abd5b980f48b52d2177fdaf00d7352f34490ff8a6b268691cac6b8efbcea01ad664d2142d89ceca87acf197de19887125bf8a6518803b0a4db2e363839f89f
-
Filesize
42KB
MD50c70ba4824a2421038d592cee97d969b
SHA1feb85ac2de91d669592a1b1b5c7a4d7e2013e288
SHA256509e78aa5ed73971583401695b1d8f1a1cbb200723beb069879e0dc5edbb4d6a
SHA51202abacca98f3605f7db7ff04814f2108d5af423c6b2503036fe3abeb28d214502f718af6861b43680682cb2d64b96bb2f905fe72a855670012bf2dbfb7df6021
-
Filesize
1KB
MD5cb9daa04377baff1e85083762b9cd2a2
SHA11768e2af58381c228f83a6e027a0b44db7da9044
SHA25632c4430c3cbf4aadd0e7aca9d5e1046f124dbca573be896d188195809a73d8e2
SHA5124ad925fb6e0b72d1543523baa39b2e81c647028894141948b972595520dd674db10171dd5fe2efed2739d1b711b87fc2c3e2a7d2b7e30f1bd0883633152d14d9
-
Filesize
355KB
MD5dcd48688a1e6948c3c78c74383de9060
SHA1efa8fe743b290703b7d49d397e384e1c0e50924f
SHA25666df5cac60e486bafb5be36c1a02973f689b731c1c3ee608ef11ff4593ecb8c6
SHA5124fed3ab0af2d9d32daa0e3a279dba704aa092fa1d5c1b00618f6637a3e679ff64545c06819a121965e260707264e75b0392d6979ee3d61b1ece8a67d7f355d6b
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB