Analysis
-
max time kernel
112s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 01:12
General
-
Target
7482086c8dc729e776c75eed6cfa3219a18862e57cb7fbc80f78cb39ad17228d.exe
-
Size
218KB
-
MD5
8eb16da1e38d1510da6b885d5bf99dc8
-
SHA1
3ca538fafde1459c8951374422649ef651c2948c
-
SHA256
7482086c8dc729e776c75eed6cfa3219a18862e57cb7fbc80f78cb39ad17228d
-
SHA512
484098b8a16e48819c3f3483b36b0c13afad4948e125152bde4bc19d78aac4fc97c867f3f26d3d48dadd6cc4ffd4394047376c08555baa2877db1cbba9520381
-
SSDEEP
3072:2vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HO:o1SyAJp6rjn1gOObn4b6h97
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7482086c8dc729e776c75eed6cfa3219a18862e57cb7fbc80f78cb39ad17228d.exe"C:\Users\Admin\AppData\Local\Temp\7482086c8dc729e776c75eed6cfa3219a18862e57cb7fbc80f78cb39ad17228d.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5e286ef81f0715541e9519d3ad2d29854
SHA1a217c83e778187a8831f19c070cf182a3f21e370
SHA2567a969911e0fe63a4acd6cc2a3e809662a17afc84b35f987f900d3df591088c8f
SHA5121a9b51abf5bfc09eb4f69065bb244ef2eea88e770c0d9714e24b248fa72011fbce8100109a3b0922655ae41971dbd8f6de2a77f5aff66cc9ed94f2ae73fa2f0b
-
Filesize
218KB
MD565adb056348f314a40e44a902aca85aa
SHA1dc2ae2dcebecc3eb1417e8ed7089907bf69bf6d2
SHA2564c0a4fc552deaf4ae8913aa143af45527144713bf4545674feda6d9df04dc51d
SHA512e588418b45a4ea6f40aee8529ebd02e5ead9957323f2bd01315d235d2c17c36eb5031e8fcbb0ae85bb4f466b855472af0175681461ef2f76bd23ec2c18ba31fb
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB