Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 17:59
General
-
Target
0b50516360c046555f44eae550225efe1dfe2f89e4844f07e8527a3aef3224c1.exe
-
Size
375KB
-
MD5
01dab4fc547ffb8d588573d4c8c74b57
-
SHA1
bd4fe08e3bb9559c6c2782fb91239b3571690809
-
SHA256
0b50516360c046555f44eae550225efe1dfe2f89e4844f07e8527a3aef3224c1
-
SHA512
d603ec583b12e9252a3a635a7c601b928bcee83bb277369941f38d02740da77a55ecc63bb9794364fda192402fa7c95d839c6766029e524c8d53e384879bdee1
-
SSDEEP
6144:i3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eis:dmWhND9yJz+b1FcMLmp2ATTSsds
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b50516360c046555f44eae550225efe1dfe2f89e4844f07e8527a3aef3224c1.exe"C:\Users\Admin\AppData\Local\Temp\0b50516360c046555f44eae550225efe1dfe2f89e4844f07e8527a3aef3224c1.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5b753af702166842a920447e103acd97d
SHA175bd95a2821cff775c7a04cbd62272d582bcbe94
SHA256c79d024a7a95fcb2b7de49f8759e691fc1f63bfb955dd4084f6590ef3c35b28f
SHA512613149aa66b0f9e8c228eeade031ce951c51555998b2af0cf127d88cfda4938c216fc0181644cc8cf887e026ee79ae9f0a62814c3d9100dd57670cc7262d08c1
-
Filesize
42KB
MD55ebe7b416c9f68f9b96bcabd8c353a42
SHA152a00ef97941dca69d17cba81b5b5537d314a170
SHA2569b32e4f490ca6580f6e01615ab028f80532703bfd800faebf6c25b5c7111f8e7
SHA512cf7c2f5a731cc648a49744bf8b4a65b39d64b62d5f287bc4d138acc5db4e549134a26ca37a30f52ef638b522a23d83af89d0502d3b8d084c5712d5dc59dce0fd
-
Filesize
61KB
MD564fe9eba9785d94b95ded1d70df36761
SHA16e227f8b61f5ebd47f710dd745abeab18d14d507
SHA256a46e324de83bcb3ea838622f8287ffab157707b35d42aa859b20bcd4ca92687c
SHA512538c0b68f77798a98e0233cefcb00b0a4709ad4eaca9f9e69b864a701f56ebbfa82c19a37babc2dae943dca2cd04af36c00bb9d4cb0a095806120b01b32fbc50
-
Filesize
24KB
MD57008ddb32ea7295c97a9ad43139ae091
SHA1a19234185c94c32ab9f5373c2f261798266a26a6
SHA2560f2907acb5d3efa62eec78255f87a2fefd0a35e050cad671e3809e43b8269c43
SHA51296c79f96263306b587155ee8cd9b0aa100dca167fd6c988bb93f99a628de7deae2db5d11fab455c92567e73631d397de4bad563b4e2be45cefcc7510d37f0b7d
-
Filesize
481B
MD541979e3773e2e60a38c13137d6478674
SHA17ae8cab8d1b37399fe8f252b5f75b6253d38ee2b
SHA25661d4873d8dad861452326f865048d16ef128d53cb55b57c3a4eaedbb121f1d7d
SHA512b45f7813bdbf8718f8270b1f5da3a68bd946b346705058b44c839cfe9a36b7b468144917996d09f0aae1c3d50ca94717021c97d9e884ef2ff9a56e9f4ddf7fb5
-
Filesize
1KB
MD58cfe1ee9aef64876b4b17cf597130e78
SHA13c150620ee22b9767770fb48c4518dd9ddffce24
SHA256cde9d232181fb117a4cc7433a383444f79fe9ee48ea4b603ef9cef619fca9e90
SHA5129f02f5f7ea14327fd90c457a9852612d8c34e6e306cce875783b104de6c0b0260ce532b8bfa56adece1f76d4f76f0bb158aed30c925ad9982ec5509933f8d22c
-
Filesize
375KB
MD54a4d9c115087b8deca3f83fbd3b14ace
SHA158925298d8853a668aaab4e91fe438209fc634c6
SHA2560cffbcffa600927275e5ce29d08e1b682e57a7b5b651ee696f08b420ca174229
SHA5122ca06668c2ac0a2758572e999530e4ac351b278adfbbb71662eb2dddfad82dae7648abc5057e027e9b8b01f34bb6ad88dc91e4a5f7e21b135643b492e3a240b8
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB