Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 01:30
General
-
Target
b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe
-
Size
399KB
-
MD5
c5c31a95f5c95b7c9f564e484801b39a
-
SHA1
180ef2dab173973a523eaf0df3d5d7705fd6ed7f
-
SHA256
b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a
-
SHA512
8c1603ff51493032201b7419edf3320b8a3693ee0346d74faa52d87c40c37bfbebff541bb73dae578e9e9daf90a191197760039c929684b27f2f6c7cdfedc43a
-
SSDEEP
6144:Y4EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eir4Xd5Md:qmWhND9yJz+b1FcMLmp2ATTSsdr4NW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe"C:\Users\Admin\AppData\Local\Temp\b121fb0768c2fcda2331c71c5af87540d8719a50e7752db976d578213c6c721a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556822bc4aa4f0b455b0c5eb5dc2fdc48
SHA13a94a7d0e4b316427da670c7a7d5748c237d00b7
SHA256905269d5b1e8cebcb0c842eecd6aa46358129821a549dbb51fa30c83c694a87b
SHA51286bd8679f987dbd68c9bae7b41d1119ea54aabf96ac467ea8962f879ec00ca45e192b5cf8866c34b19bfe9e8ebcf6c14c439e52e1581881e891473a076e4cd1a
-
Filesize
481B
MD5176e71d9dd4853f417cb5b3c68b0cc1a
SHA1dc57300dbd3e221e990f50b61657d2cfb08bf702
SHA25654a3c7a1169d3510b59e5fe5d400509646c5f61700763cb830fe3f9be836180a
SHA512c420580ab935da6bac90de7f017c2e23d8650ae4ecf23532e5f189c151771ed533363e3e73b603302536793ee673cdc0ce689c7e6760264dfabedd9f99f4d046
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52bd0b79d8186dea9dffa497613ebe849
SHA16e221cc6d377af28705a498e2884b95440a67d59
SHA2562588d34bc3df5e67b77870358b653c44dd7483406c0c4f7f0b255b34f4bbbb4e
SHA512486934496556d938214416e986199c1d398524649332911e62ae32f8a3d1938b59ceeb797ae183ea23c409644c57f20ef10c418e2205c216b8828c77bc37e999
-
Filesize
42KB
MD5e421b82c473018bf9f2e0f3a9a45694a
SHA1e165b99d71f4fb0fdaa64e34009432693cd4510c
SHA2564f4721e5e9dcf5df15df6f5a1e98d4cc892974c5e412b07fcfb69d9fa792fceb
SHA5123d7f77abd335acd46cfd8ae7a8b980bd765c88bc4f04e1e1d6498653e81ba5a295ece9e4b7faa946d22968c3bf168abe8d87be45327c40ac2766f54fb683c9a6
-
Filesize
42KB
MD5a84ff3408cfbc50746f148300a38758c
SHA1d9b7d020485a6b4cc3b73af6f76cb8111b117160
SHA256bed67ddcd9582f5e253c9b95aed27c0dfaca5796e494dc8685a32a57cfe7f582
SHA5121d7338f6d1b8a5820a5dc66e822fdcca3ebd510d5add20e5e48d200763587b7a38ed3818d93ba7f728860c46ba9b9f3dc63eea60cf496c61206e73dccf51357d
-
Filesize
399KB
MD59445f4eff22accc880c1a5f2e160a391
SHA1956071eb7c6e4149e80817b8fc8f34ac78700579
SHA256dd68a2dbd87baa51ea33d2cf20ebacab2ca574f9f43db58d2ae5580102cb7c82
SHA51267bda2c49aa5790795bf025900f77e847b7f720f23cb5553641a45d417c48397a0675a2666d31807d479a1ed8b4240ed75e5cd3a5f1a5660dbd3edf41651daad
-
Filesize
424KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB