Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 04:34
General
-
Target
ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe
-
Size
208KB
-
MD5
57b8a762f74a81e2b6d39487ced997a8
-
SHA1
c5200b1584e498d8ea3596085031cd7cb2208a4f
-
SHA256
ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637
-
SHA512
7eab54cec12144320c3256039c50430abc75d8ebdafa3ed304769ccbd9fcceab9730eee2ab4ae9b4639248cc7632f8b44d4870303314e05251adc6f25e97390e
-
SSDEEP
6144:4a1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:4bapK0JCmRcU9vVokfp
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe"C:\Users\Admin\AppData\Local\Temp\ff9f3ef2388789c506f3779c9b8efb1e19b657a8bcf69951229ef03a5e02b637.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f5a8cb429a87ff062050752a979bdbb9
SHA1745162d55a9808ffff145c6ec68c63d6f7605625
SHA25643c13fc2ce8548c893bb26252498af9db8b2ff62249cf628a47ac23ff06fd9c2
SHA5125963124ca7e643824c41d99fde1ba1348d1f92b75e7c302f4c275b2cae4fde075a90df47ef7915dfa99cf49d6bcce29a0ce48904e26a67377190d82aae29706e
-
Filesize
61KB
MD59f80d898e1463b47cf829dbcc22202b7
SHA1d4b6a63ed607cac81c5af19aa0fce8c6a54d2a30
SHA256b5e940f8a27f00e5a143f61d4e6fd08a1ebe43d2620752d9d87fc57fe00b93dd
SHA512436686d135810bded93a53532fad172d2d3d33e46ed48ce7ff78d04de69cede3c9b65675efabfab03d83b5939b2f23c952f471a00dcfc648f92d0203b7df7ff1
-
Filesize
481B
MD50f436c24f70ae7f8f78cdd1fe53de493
SHA1ce60a49def5f7a35b9885bec5aea21ea159ea59e
SHA25617b47b000d07a0f4723a75dc3c7e33f3cacb4ed2da1329115d04ddba8f06f7e5
SHA512de11fa91959392222306c93b1600ab7d78cf78466f9ec692c20cdacfa193899e2267ae42326e7ca8ebeb403f7ea8ed65b1e3efa6cb314280ee7ad2e6bbfd5bbb
-
Filesize
208KB
MD5dca333122f2b26bbbecc2ccd5438ce18
SHA192a07ae853d084fdc4f88a3427090fcf29b8ada0
SHA2563e3483ca4e5f6f916d95ba06cbd393337cb89425083d9a1530039e95e478000a
SHA512d6e7a99b9e72b3865f5432575411e064218cf8db36663898682c934c279898d767fb295475b0a266be8f826896c567d5255ba76b7f8d0b5a37a1d7ceacc85c80
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB