Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 12:00
General
-
Target
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe
-
Size
218KB
-
MD5
08a1a3882d1d36c728c9f0f9c9e72e5e
-
SHA1
32cfd24da914b975803e986b28797b43ff17e156
-
SHA256
5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8
-
SHA512
f005290d3e5c554b94f037dad37a5c75e7b793abbbadfd785128eae266a704bccbc78bf235ddaa388df58bf224e83e8275cf550e072f0724216d81b45e524135
-
SSDEEP
3072:pvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2He:91SyAJp6rjn1gOObn4b6h9j
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"C:\Users\Admin\AppData\Local\Temp\5bf4c1aabf4f6ac6e57dbfcbeac56936c6b8488e7aed9c91c8ec8bc2aca9caf8.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD5b470a926bedbb22196e7aca1887f6a33
SHA1b336bfee28b623ce79819c96356b87c8f4093656
SHA256af3458813d8aab6c8ff3c31d6c426d593ab6355c216a0bc21624eafcace7e632
SHA512297c9ee2a7d0c058a9d5ef61a02e9828ca5e5d8d670ddcdd00dd31dd19a29921d2511490a1d6a177a4665c1cd7873477e18916312fd5ebc0cf646c29c64568d5
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5f24f1fb84e76187b92906a2a1c059832
SHA1f314e2bb5f41088527ba5bf75f7f2404cdbb0331
SHA256333664bf82172818c5299042a36974084e74ff3413db8e0e0efc306823090c8a
SHA512016522324f119f3ac15b2155abf8e1e10235844eaa79794cf3e5b3ff079f672ddc5d8a36245ea0140538c66c4526e8f21c1d76411df74eb0e6e23b9b0b97e67b
-
Filesize
1KB
MD55c7295489f247ed18064e424d6759e27
SHA1396191d35c5ed9f0be8d22057abbd8ed4cbc03ce
SHA25683fb3d92fa38c7ab2d345805a7a4ebd513cbab4fedcd23c8a706f1dcab54d9f9
SHA512353db7a167f693fbf18d88f8e7191beebf9357cbf21f338889ba76590e9911b14ac377152efed2ae5c6b7b394699a6368b00ac92083698aa152f99f5cf1da42f
-
Filesize
61KB
MD54bd2261bb2b14da99f7109c9dd1027be
SHA1d1fb0216b8c85a8744c0b00d78cb5436601d6c26
SHA2567fdfbd5347ddb66a42e378095a1701b9599819583c2a533e608be910600a08f8
SHA5127f668e9082242c161c0ebd90a2a76c92d860b2b6dfafd372605880dc4e5d56cafebfac7da86533c84123204d0f766c497af9a0e1914c53c90ca3d16c4091eac6
-
Filesize
24KB
MD5cef5f6a8c6aa05230f86fa0bca3f712d
SHA11fef3294febdf46a04601499d22a90de109cf5c3
SHA256e2b43b31023a854be9fe3217782b6738b5aa0b894b8bd9994762b4af929322b9
SHA5123a8830b4ad39b3c7b203c070d0d25155a4ec7d5f77c3b1efd86d224f28d4ee41e68c37e54b13ab37a6bf24d753e9487c29a7c32b62ba40b972a6a3fd1c882f0d
-
Filesize
42KB
MD5f51144cb0d1b46ca9838cc7df8388cec
SHA13148368d2585d22a5132ef4974a7c0fdba165f01
SHA256f33c716755a99f4ac999c7e3b09bd11202cefd4df22c2dbed2088d2373db0b80
SHA5121ea244aca6a56fffcdfa7098af7069ac226ac5ee09237bb27e062db52a6675a2babc4adc19905f060fc0c0f5f71d37021fd204307144e3556123c834f3a62f2b
-
Filesize
42KB
MD589f37401e463858da8ffdb897d7d8ea0
SHA15ca8d69b4422c37b17e9bc22b5ad221542e34af5
SHA256da93c12e62baf058ecdc69fdaf3777f7d88ff06181f93ab4e58dad809170f129
SHA51283274f677c7d39ef7d9339dfe1dcd5533f445bdfcbe2c40935e940e719ccc2c2f727a88ea0cb0e3b2f796a0d84423d6847f561cbb3b0525085c41dea360aa1fa
-
Filesize
218KB
MD512fb2c4e74381aff3e49470a9accd0bb
SHA1679f40b76275f42c23b5f8e36176b1602843b2b1
SHA256f310836086480414f16ede39694f05dd8903800e37e8e3c581ed8d823b53ce59
SHA512a804ad273568854efeadeb410ace7ea1685e48bab6bb923a6e83b9e7ebfd8b0d84f393b5df78c166bc87884c3105a5e4d78289527351409bc4bd6dc51416c6e2
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB