Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 03:17
General
-
Target
e69a5e46eb4f0b9b628e8a1249eabeda9b97a23c3176598aecaac7bee5983683.exe
-
Size
375KB
-
MD5
8d9c3f2f097fcec1d0614864cddf7251
-
SHA1
2dba981344c3e77225c3a05ba90e0b4319393297
-
SHA256
e69a5e46eb4f0b9b628e8a1249eabeda9b97a23c3176598aecaac7bee5983683
-
SHA512
a95f259668769f607ffc56d1ea978a0c18a7f82982fb4dea2a28b94eebd4169a43b7a2f98b47b910616882fa53206f28d2f3e9b7ebce0d853ba8c5e879cb5173
-
SSDEEP
6144:u3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:JmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e69a5e46eb4f0b9b628e8a1249eabeda9b97a23c3176598aecaac7bee5983683.exe"C:\Users\Admin\AppData\Local\Temp\e69a5e46eb4f0b9b628e8a1249eabeda9b97a23c3176598aecaac7bee5983683.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD543b7de5653eedae0fcab1ba7b2a6b202
SHA1d75dec87000a53f08e4c787afbf32411eba17796
SHA25607a56dac3801c42a1d91f8084ecb714abbdf3188750878f5afb82665b68cdb47
SHA512c25930a2d7ef8511aabf38485e2d27e73af0518c6d6dff6a78c8024253794d3b13ed0b84493a5f712dc67bdd3af71033247dcfa2f17c2ec4f58247a84ee64ab8
-
Filesize
24KB
MD5f5823df098a06a0c32b268482f6f7fbb
SHA10204a579093bc9bf644e9ac7140210deaa8d8f03
SHA2563c0f40167ce989d8720ce2a918f367f0bf58d4a0084dbdfe31bd3e97329cb287
SHA5126a1e01a5fee8de34426fd81d6c664c3ca2d8a096c2a4476fb1df97eaa65913a9ddf76a626d0832bdbdd4958eb7870370c7ce0ff0f120947f36ca7c92b7a56c1d
-
Filesize
375KB
MD56d534372097be5a9e58b35d0258423e3
SHA1cf0ee6ab7b120fddbc0dec83e905173e1049d912
SHA25698d95a314eef5ac72e6e2df568f86eb57dc38056bf184cab41873d88013577cb
SHA512039755da030223cc8d797f43baef0ff744cba675fc213d72ba0a3684d1427031d245f0caa1371d5069d6214a55534aaf456bcfbc7eb80ea7209e73eaf25f91ad
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB