Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 17:01
General
-
Target
11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe
-
Size
375KB
-
MD5
2a73ab8b9b81946bd36370152f653134
-
SHA1
8c81339576944d187f02ab8e12b9b0b9b58c61e0
-
SHA256
11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc
-
SHA512
4cbdad972cf57edf83b9e566ed02bb0549e32a5f1060e918232ab6e88f24f69a3d026e983b956c36b3bad9935c4af8e6d7b9b0603a32a33448629e3e6da94f61
-
SSDEEP
6144:i3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:dmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe"C:\Users\Admin\AppData\Local\Temp\11677ed1f33cc823f1306fce63b03ba8fae891b946d2f6eec18e830568e32adc.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD503c2bd61756afc06ed089c4f3147f65e
SHA119c503a782ca0eb7194a6a5cf64e14ad1ac0575d
SHA2566b2ed3399e00abace1e1966e85ccd4ce029a75339ab0814591190a4caeb0c741
SHA51214e91f5cb4e8c69bdb6865ee9b65036977cfe8e01dd5f28dabab36ecf0555d7ab3dc870fba16fa5ffcf2db5d9d2d843e7a0148d9abff85cc7cec5b02fca916b1
-
Filesize
375KB
MD5f4fd3d37df9e916429e2b539be8d8c05
SHA13c0db1dd62fddc42f7e13dbd0148e8f4a33c735e
SHA2564daf6c82478fd207a8ea7922bfe8297a7a4455ec5741641ef0f0ecf79b4cf8db
SHA512f8a56ca5a76cd5c8684a04eab27be173973a16481e231f2b76d211f021bf2c5f6a4795f4e1651e76e04e7c13a11ceb4dcd340648e017f75a4b5cf6680cc89fd5
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB