Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 01:27
General
-
Target
9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe
-
Size
686KB
-
MD5
78cd7dc2a4206dcf360b50280ca7f5b7
-
SHA1
1240d870db37281563476427b8c358d7814ef6aa
-
SHA256
9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892
-
SHA512
b9f4920be52325d66f3c6f9f1bde07b11f22858203881b727ff98feacdb506387ee9e79508838f2ea86d6da7f96b82e27d4a7c558ed1175b916f2fe892b3d0a2
-
SSDEEP
12288:9mWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:9mUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe"C:\Users\Admin\AppData\Local\Temp\9809679c337d50bf09cbe51b454173f39825688da9833648c312a9c801458892.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5199d3ff53167012e1583e2d196df4870
SHA12b46c0b2f540f216dc3d2db3fa01b0536d2caa6b
SHA2568f779af0e9ce27b8a68426cba93a87a5a3d425f3932cb560d65fa84f561e0acc
SHA5122c1d2c26da2762ae09f74f91c937733568ba76a8b42d8d50bb99c19c7c87aa3345970b6cc0841144c781ad4055b277bac5086a1a71cbe8795828472d97773c63
-
Filesize
24KB
MD54cd8b67be4bd83872b2cec58279ad5b3
SHA1de42ec0262b570b3aecf939f0b0a3681e3645838
SHA256492fa0bc9506e0636d42d13b05a47bb0c32435cfd0eb10e8205c2d165632c0c2
SHA5123c6e9e0d6176f2812eb75482976290f61c940947890bb66d293823009f5714e084b95e908de76e991f097c29d0de4e4eb21296778835d95a202290f3f30fd203
-
Filesize
61KB
MD530896a393a380d68950cd9e882a929fe
SHA1d79485e03d10132e7bb4d9447d443568135278fa
SHA256d5d6fce6978068e9c7dd9893a46cca1ca24ca92d87fd224125f443b7ba37c69e
SHA512d39538e430949ce83ade51360e535f17c0708b658fde94d36888b02bcde5ff443e5c9b144338399f32710f4e2c3c4ef53c63f45202a1feeb3d2400a9c2214923
-
Filesize
481B
MD528965e33a729de69d29b087237fe2664
SHA119820935d7c34015d7bcc10d25e7e6ed750a8b63
SHA256836f84e99cec2afd599059b6a3c49bc888f876d5af98a9bda95a64275648e631
SHA5127f6c5cbf8bf88874e85b65912958712db3fde05c4b99f48a6bd469e2f76f74725d84a1261cdf74f207c8deab52b6884d8463d7f3a8367d8bacdf54e16aad19f4
-
Filesize
42KB
MD53ea11af974f145b91a43561db8eca55b
SHA128fa97ee56ebdaa2c73b84dc7bf7a44573aa7b7b
SHA2561a977481dd86ca3a7bf988bedff7f2b637ee83689418db91ba6604e479d0a9df
SHA5126da086c6c9d41973b132f8fc92fa509231d57555a6a48730c210c06cf1bed26c7d49f4e03ce965e13aa0fedf1882609526530017b6ae3cfa4fee0e6dec5975c4
-
Filesize
686KB
MD5821123c295e6045cd7b463224cd3356b
SHA18f59e34bc28f2da596559f326ea4255db355b3e3
SHA256e1698237747fc6f755ddc0e9c1179aa578169b931a0dd5b0db98096fb2dfa94e
SHA512e8dabed2b23112a60b5742be33f4c35cba3c420cd12afecfae19ffd6e505c0053de8779127d2daee50326cfb07205d555efc94426a6af3c3c6a06132ab8468b7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB