Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 03:23
General
-
Target
6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe
-
Size
375KB
-
MD5
3c508e8972aea1d101e00000ae16677e
-
SHA1
a4715f231f3084c93989fc761f7f767550a38949
-
SHA256
6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b
-
SHA512
639865195ad7ffcf49c49c321180ab329dba03b70997548c733c071aaf0573c73aa03d50db853dafe7a26fff3a523506566a0d933c90fc98f800a470cf5c19e8
-
SSDEEP
6144:j3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eis:wmWhND9yJz+b1FcMLmp2ATTSsds
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe"C:\Users\Admin\AppData\Local\Temp\6e5b4963e07380618030a1170597f9291837e211da361ba0152fbaf43186896b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5a131ef3fadbd1b443b056e16f7b4da84
SHA19b6bef5bb0c0fd4f431d73b03331cca8a115b04a
SHA256f692b0f69032c7823eab247280be62f10c6c00415b189a68a8a078bd69ddc974
SHA512992def4395a9cfa6559dcfc4b61c22c105caf0c08fc260ae8ac46aacda089b6894a6ed67478ea65a1e20ac35dfeb93ae80563aac8d9c910d28204739280349e8
-
Filesize
481B
MD52d24a67b804836e0064b637fab7c9e4b
SHA13d86679280564b9bced20e13af6fb31adeeb3a06
SHA25603ede3247aaf35d5f650797abc63069d26c5acc9c27b64fdcc546b54c2e8041a
SHA512f65b9c16edd35ac4a4a0c328464c9e9adfa59e6a4256a5a4477ae8f1bce6b4b8e70fd72959d72b77dcf9f94be6e28c6b9479c304c4dccdacb3fdb26d4c731134
-
Filesize
1KB
MD54de70bae1eb72fd47110e86f34ca098f
SHA1c583e4f9422869157e07273f59cf84c6e2b17570
SHA2566b42354eb97e219a38d83eedc1318748399ecbd150772cd0ec441b532f69004a
SHA51279ca5e89ae8d0887efedcad729a1b8bce973ef6ff864d3fb3dcf7caf8bcec45569242945e1dd8acc4fd79e842964319d6c0590a4cc7b25e1e1daaa6ae8bdb5ff
-
Filesize
1KB
MD59096b006ee7b6e5be8d910b393e891fe
SHA186c906f53a786faf2a3b54de2725d46e4d6fe2c0
SHA2560baa97f38f65df55145f633d19b0d2a4c6025b0b9c67a0e225319a358202a11b
SHA51279e92f9f112f9d2506a74d59fdc9572acdaacda25ca473a3e12c22662a3e863c547b52ad7bbf42a5e3c3fc79bb2d2ddc31abf3be5bb31b83529c50fc829d6598
-
Filesize
481B
MD51a391088cb4c3ce11b9d418ab5d1d9d2
SHA112458b9ce73c69110c2a649f00eaba3ad2a2e2a7
SHA2567733994c843088ac887d13f8c8c47dfce103873df99f7c44c3910c8313006db3
SHA512bc0976722cffef898084c5dd766a60752266c4de670cf3931b1bb6f0836fad993f29d2462db027119cb7de1d5b72dc595ecd417d65f9597a89e969aa44721963
-
Filesize
375KB
MD5c34c0a8a0383b0d40c290b28551ebbb8
SHA119d95ad5d3703d78dc27eb8291c3cb02016aa84a
SHA256ce4488a5bb8295715f112f882a3d241ac49ff8ccb495c050b960809472183c1c
SHA512684042a82b065b2f05297895b37a7e4a0c30f7f21eaf651f328e3cc8851d23e443df7995ed2f1fd7b2727a4f1229b830fd25ff730839f864407bb058097a95d6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB