Analysis
-
max time kernel
108s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 08:42
General
-
Target
2cfbc27380e5346e242e690ee879adf88884f28446684c0e5cc7bf2972bdda06.exe
-
Size
375KB
-
MD5
bf4d299f7eaf4526dcac67d0efe60bb8
-
SHA1
2feccbadcab65c6cd5304f6cceef47af681940ce
-
SHA256
2cfbc27380e5346e242e690ee879adf88884f28446684c0e5cc7bf2972bdda06
-
SHA512
f0eafddd038d90ad8814f5fc83104da2c8f78f8100c0d44b30e5a1fd150a22db935cd9f1beebd97981cbcb4dfc2a4cbbc7628b2965011877aa217d8be508ab8a
-
SSDEEP
6144:63EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:FmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfbc27380e5346e242e690ee879adf88884f28446684c0e5cc7bf2972bdda06.exe"C:\Users\Admin\AppData\Local\Temp\2cfbc27380e5346e242e690ee879adf88884f28446684c0e5cc7bf2972bdda06.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5303527d052ddea307081fa61c339ecc9
SHA112b26341313b94233922a62b510a585d76e2aa65
SHA256e06c2b98ed710ed839dd9e001fac53485cf51992e00444191ae0e830a5c0b1ab
SHA512554f9e5623dcfad82d621c2e8adce1ce6a69ae2c1a6f32d798bad654286507b6b6e962c2cb96d0cf8205962e308c11190ecd520e24964f2cc90c34fe4ea5541a
-
Filesize
42KB
MD55719416ec2283838c467318cb81724a8
SHA1bbb9899f0aba19cdf58379359656a7e2dc1886e7
SHA256c29a028860251c1c326c4444560f7542e4790a632e53725dac161de0819122bb
SHA51233c8a57a2f60be9b72b9497d01356c7ebd999410d5aa10346975e255e8b7622c70df93419404569b1f7db1805d1939c9287d10ab622717bdefb6caf94877b672
-
Filesize
24KB
MD5b22fc14c9061688a902156024257913f
SHA1d8935fa00b8d32b221d65e19d4e977fbf65801b7
SHA25635882eb98b661a4c928479516bb6517901ee6872a342db93dfa21b93c65e7848
SHA51232590b1608042592d2a1f7a2bd9e3d0a8bb32dd034bc877f73814c90bf49f3c7bdb66090d272fa33e6ee231d2fa034080f0b9a28d257b0000b757e13ee30e7c6
-
Filesize
61KB
MD5416e94b39294c6b4c8fdacf3d2fc972f
SHA1acedb3c0f1f8760073ca858b24f43415b8d8741e
SHA25630e7caf6f17a1f11afa3a84f95448b96af468ba97f4488065033bfadacba1125
SHA5126064a85c8269ada4631a71c0c2f81e73a4f11d7faceaf599da37a3f3f127ecab36a82955e52fa77466c1c6943f321ddfd76a8232a2d8c364d4af5e52eaae6183
-
Filesize
375KB
MD5068adf33333762b336cd64de858fece5
SHA12e1795a9bebb15cc01f88c6fcf3adf6b47006d26
SHA256b22b318f21e2768b77647c9891097d00744669afeda784d8fef21eb5f5642698
SHA512c43947a71e8cf2ed9e0fe79b7af6e301204c29ee8ed6f7cad23f73a7db0e1a768a0a8e6213d051269c7db44b8185056fcbba9b024d9cb892441a2f9b74d6e0d3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB