Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 21:09
General
-
Target
77c97a7681048e2e4c8ed52e499bab4b6fb6e2bb27d1ecd84ce3c2dbef95466b.exe
-
Size
217KB
-
MD5
cd22bbe6781639a6da5eb0db08ff5729
-
SHA1
3d516448ea877840b4592de247de68502702d74e
-
SHA256
77c97a7681048e2e4c8ed52e499bab4b6fb6e2bb27d1ecd84ce3c2dbef95466b
-
SHA512
b887ec4f4ec8c847a824dc8b3298717db8f3c9baed25d4f9f5daf62c985fcfd7f19ac3544e970d016223befb5353bdf0140867365bc29123b7e22043d95ade20
-
SSDEEP
6144:TrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:/sTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77c97a7681048e2e4c8ed52e499bab4b6fb6e2bb27d1ecd84ce3c2dbef95466b.exe"C:\Users\Admin\AppData\Local\Temp\77c97a7681048e2e4c8ed52e499bab4b6fb6e2bb27d1ecd84ce3c2dbef95466b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e9cbb16f7788d5422a5183baf2be80fd
SHA1290b45366429aea1e34b1b225974e24cb8a3e39d
SHA256aece0ad5f645b487d139a401e924a370cde1c4c02b94ffa6c25f2497fda3acd5
SHA512dade034f490c4a0debab6383b4b7214a20575bb3aef088ea56209caa4b747400061e6ce5900362ccff42e3d1956f614670d5b77f3bf866ba8be2e1cd7ceb3aa4
-
Filesize
217KB
MD56a93485425278a8c7361c794677c4a02
SHA102faed9cb4faf276811948f7a8466d37469d75fb
SHA256fe44b97cef124fffee863d460e2cf88917285ba4bc5cb9e0e702c1b74a8241f7
SHA5122f1c6f68fa3ddaa77979e9d893ddc0e95fda62dac103c3584fcdbbaeff41b4d00b7d98ea3851ffb1e7a5ba6514ed4fb63381db5371df861955634c3eb452442f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB