Analysis
-
max time kernel
116s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 22:13
General
-
Target
4ccde9fbfe96c23a366779a5fa0ba17e7d328261a5dd40c2fa1d3b121b0ea7c2N.exe
-
Size
375KB
-
MD5
13aef079387a1e1e4b79068838093d10
-
SHA1
37d37386fc829aa710da8967a7a790126c58f505
-
SHA256
4ccde9fbfe96c23a366779a5fa0ba17e7d328261a5dd40c2fa1d3b121b0ea7c2
-
SHA512
7c5b08a325e1be6e85ffc95bb00d197d4cead8400be0282e22df6df3d5cc96723ec19ecc6f290ffd3fe5393115e005a36ea2cf34aa96b096f18ecc0bcf298e9b
-
SSDEEP
6144:j3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:wmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ccde9fbfe96c23a366779a5fa0ba17e7d328261a5dd40c2fa1d3b121b0ea7c2N.exe"C:\Users\Admin\AppData\Local\Temp\4ccde9fbfe96c23a366779a5fa0ba17e7d328261a5dd40c2fa1d3b121b0ea7c2N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ec437e56f7709e8ab823c3d84b1bd8fd
SHA152d5868b370271fca2d9a20278b0e7853e6f8a86
SHA256d467b26ae67d3c61730b06864ac2a07f154244a97d6bf78dec2c2c93063bd70e
SHA5122e8c69c80bc5e5075d8db2be880c27a09ecbe81158764c40af64b72d42370172c211ad47b5274b1b57475fd2c7dba90110935dbae47c2824591f160d2c898262
-
Filesize
24KB
MD589f8158424c5855261b9d04221005ec9
SHA1bade98738ab0e5e140bf161f6ac72cab51638ccf
SHA2569a03464eabd603d05c2b1fd67425ed9ae74401f79fcec11d593bad9e421e24ba
SHA512f6d4d824ebe79e1345bbea1152e17b28ddc97c0e7e88fd66122d699c1dd7f2b6da5b6dca3099b9b4357207181743967ef331262177e2b202db5a3a22ef71089c
-
Filesize
375KB
MD53b262c8e86e2bc84c70c36150bf22cca
SHA10c6240f478d7d7bacc4e4f94bb90833a6c8ee8f7
SHA2564d1d392b6f555842d6d9ac2e897051c2a14e4652bd9dd35942fdfe7921b67045
SHA512dc5f9593174b08f92fe0c34fc08e03e243b0975cc53a1d3e3685a3514f40f69b4870ba0cfd612ed4403b25bf8d7b8133445f4fcab945323dc36233e20a06842d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB