Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 00:18
General
-
Target
080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe
-
Size
355KB
-
MD5
29b51ae571e83e77c4f9b238092383bd
-
SHA1
035018aacf89f106cf16b874d979c3756526a1f7
-
SHA256
080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496
-
SHA512
3bb28ea98b382a3f2f24ad98df588eacd069364ec6d0a37a97a464c306c6a5ae3888042f98b7d32080cf009a912bc0b42120211d96de0c8dbf1beb4c9b5fe124
-
SSDEEP
6144:egEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei1:ImWhND9yJz+b1FcMLmp2ATTSsd1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe"C:\Users\Admin\AppData\Local\Temp\080f415aef72ab97376fe8f9eced31164852ff82630f0625fdd801ba37c97496.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5f68f1e20679fa550eb2f2d176980018a
SHA18ec514c1ad90c4771cf90a91dba255792ccf4257
SHA2560f6de21d3c3a88bf6973d538d33b61226cfbad838fc379a6c286187fbdc7029a
SHA512cbd084451e89580b50c1fee43c49cedc3d44ebd0f7eca70704a9145bf91c61e6a4de9569b43ce099c3e0b31caffe11294268c33862d440232a818c7b5962778a
-
Filesize
1KB
MD5cd0cd44447436b064458df50aaefe92d
SHA1bd7be85abd91fb37bbc376cce708e41114479d27
SHA256bdd47b98df19801c1e67ca4c7f5c629fc90d12a38ec9d9f3aaef326c8725768d
SHA512aaf2098d672ca64ddf742c8f482fcc42a29044fcab2eec0092cfd8f8e55d53170819cfd4f35cc413d178261fa60d8b6f22192031a63d460be69340ec1bfeb14d
-
Filesize
481B
MD52682bdf36c0f7cb5ce0da0645eaca5ad
SHA1ca1d7cc01e46d34e545a4c27fd096870091aa70e
SHA256fbc0e7b7d136b6cb69a48b9533bbf3c647ddb2c4b26cb9c8ca68a11433158865
SHA512bc57b769db2cc377d1a4e5868fd8c3a3855ed17d9593639e017ce967cd5059eda3b882bbdec75445dbfb4801a0370ec9835af0dda3edf854fcf123f974073b3c
-
Filesize
355KB
MD5b550260d467749d80768a541ed8d036b
SHA17ab7c15608682b72308dbb4c0aad1d34a91b4a27
SHA25605d04e4d7eb3c9076b3a5017b85e3c7e692b781c5801378297fcd24bb5fa1ea4
SHA512fe054051969c3238f14254daa867ef8db9ff91b59b7aa19989b0a0ce7dc6f599e8d54aaa99c209d9027dbf7b385d8027aa15ad67b05a9a8801c5b8efa7aefe48
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB