Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 03:21
General
-
Target
dc00e4a70a75f72e7cdc6eb3d581937b0522260897dbd7846177128d56e3e685N.exe
-
Size
218KB
-
MD5
2e039c96992e14278914c88009359690
-
SHA1
0390d67ef3d9995e118c5f27019fb572526151f3
-
SHA256
dc00e4a70a75f72e7cdc6eb3d581937b0522260897dbd7846177128d56e3e685
-
SHA512
dcb35cca7cffe43743e822beb600220ed0f4d00768fea18170b458b29dc510deca1831393ceb0d2ef7f628d3deb191bbe5d3c2d800f225e4bfd460138dabe115
-
SSDEEP
6144:OEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:OEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc00e4a70a75f72e7cdc6eb3d581937b0522260897dbd7846177128d56e3e685N.exe"C:\Users\Admin\AppData\Local\Temp\dc00e4a70a75f72e7cdc6eb3d581937b0522260897dbd7846177128d56e3e685N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD58fdad309aae6ae0f3f7f7bd9d84ae409
SHA15dcc71800cb1f408e437ab169eb0153d89c04f23
SHA2563788105e13b40e87fc497c58c51bfbda67f58f895999a2fa2ce7f10124e7a73d
SHA5127530692a95da37a004e115715fbae327be31e80357ec8b65633e9c1eae573fbd48295332d6b4442c378bd70b9b25c2fced7fbf91d84658717ee92e62e6f7798d
-
Filesize
24KB
MD57622cd4e28c113df5e2e47ab598b8e42
SHA130222fa760feb83160267673b737edd2dcc9a9a6
SHA25665d597b73979157945e8090d3a519fa9fa660bf3685a19ea2ccd69b66485e14d
SHA5127a9ac1631e29f5e583b37a52e9b7c8001343880f56eabab981130a9dac6d9bd3d58c270767a0e13c7070cc0f80cd08edc5a4e51ecc35ab9d15dffd9d1f9e0f67
-
Filesize
1KB
MD57b9a3e34ddbe784e428f176bd95aa7b4
SHA1ea1c0b40afe9eb910aae10a0771ae2595d1232d2
SHA256d023e0678d28a3600a378e7ee496ba901e35fc675eace775e4e1082b1872ffb7
SHA51200f494afb1ce07198fa2e522ccb738f62b9144d47877aec29b608591be55c18c82f9e08004b587bf97ff493fecde23bddbae96c059fa0b5ee853d7644029b538
-
Filesize
218KB
MD5fe096da64adf06359c76aca681be6dd4
SHA1a8d275a434586223086120ad242c93a466beea54
SHA256be1ae1de2837335dc298411e9f061751a55a57eac9b5ae0592c0a8317d8fb3c2
SHA512e77ddf1bbffccacd63c21f68841cc7cf725c2079a61cfc8a1b1ce3ff357e452ffe95b2ec77a9db54d50c962152474d94da765c0861826b2ea242ac7daab484db
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB