Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 04:39
General
-
Target
62a4302dda7e6fca7ece05115cc9bf462866b7858fc60e5715dca0570417bdf5.exe
-
Size
355KB
-
MD5
e97aadd755535efa5cf3d1a907468af1
-
SHA1
85023c1e331fd6b4c5a97cff8d47ee849d81b875
-
SHA256
62a4302dda7e6fca7ece05115cc9bf462866b7858fc60e5715dca0570417bdf5
-
SHA512
84fcde8874c2a3e96e89780dfa8992a5b6d1c98340d9c4a5b3243711b9f0ee050df5d28c21124e1b40e68cf1d2eb838580a8a5aa4d2fd9632097fe30cb9bb642
-
SSDEEP
6144:y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiW:tmWhND9yJz+b1FcMLmp2ATTSsdW
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62a4302dda7e6fca7ece05115cc9bf462866b7858fc60e5715dca0570417bdf5.exe"C:\Users\Admin\AppData\Local\Temp\62a4302dda7e6fca7ece05115cc9bf462866b7858fc60e5715dca0570417bdf5.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e7ea7b004a06ce757e9b68cd6da52eb4
SHA18c8a2bddd5eeff3df5cfe1c696eb42610ca3f045
SHA256460b6f2a9c34a30abc69f0f27071cd337ec8d6ed501c22e805aa98a9a9aa42bf
SHA512e88c95f571b18837c7584ec5b9401f0b0d8465556fab1827f17fdb635bb44f714795a0a147cd3e6e7814e405cc3e015bb37679a8ed61eb54579879564aacdb76
-
Filesize
355KB
MD565ef97045c2b01411d55049fda6e98ff
SHA1357c99b027d69aae864566c7597ba3ddf785916c
SHA256e3414a65f100af8d0fed8b7c7a3e72f5815ae551afc2ae04da0496cfb1ee661b
SHA5127c1d3b1a03d628285ad2437c384b77063a9cba4eebde6e379da506baad76ded0a872b1d1ed62616678da335fea532d84e85afec46dbd720814423396cfd36dab
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB