Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 00:25
General
-
Target
e8b97f95892be643933689608c0b48baed2ea6cd0eb87b83d5e6e30004b69409N.exe
-
Size
218KB
-
MD5
d90b277f4545c1b34019aaeea8c11600
-
SHA1
a13321ade04a9e2371d266fee3c47ab7f0d38c12
-
SHA256
e8b97f95892be643933689608c0b48baed2ea6cd0eb87b83d5e6e30004b69409
-
SHA512
37a7330f8767a904ebd94d6efcdf65974d6f58a4e3e1cbf1925f9576aef80dbc114a585a97516a2a3f62ce3296fae0d986b06edd420ac79e7e117916a57847b5
-
SSDEEP
3072:vvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:H1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8b97f95892be643933689608c0b48baed2ea6cd0eb87b83d5e6e30004b69409N.exe"C:\Users\Admin\AppData\Local\Temp\e8b97f95892be643933689608c0b48baed2ea6cd0eb87b83d5e6e30004b69409N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51ae07d51ed526ba5ff9ce64878219760
SHA137d2250cd553d629b29c923504e8ee3071c36ad1
SHA2562d477496588b96fa7c66625985f827342632dc57b6f8010b78f044afdaff049b
SHA512b57153591dd9f7fe05153880c2c8a48f61bf9d6b235d5f81317468b348bfb9af5fd5c0382887b63dc0a0c855d3868172245984fdcfd456e97d4244d52725c724
-
Filesize
481B
MD5b234540c58cac9161c230d1b9724e8cf
SHA115a69e1033983a45f0ae142563f4a21a1a93fcd5
SHA2562f2871167419d4a19c0496dbf4017b4f1216467a025746c34eefc704cc371655
SHA512f5ec43009e736b573b8ba0ee21bf115f947fc5546f37eb7dcf7c227276fd421f5880040ee677555ed173575a0117b661dd244cf01782064702b31a9b0afd623f
-
Filesize
218KB
MD57fcf255c17cdd6142f44c5a059b271ea
SHA1222cc19d2d878ece1b4b6d2a192ce72478f1d3d9
SHA256dd12df82c1e1ea86ef616bc658deefe5799e08c60822221f5c7af0ec2ba339ed
SHA5120738239be555a84c9cdc55665dc1d71660d0b9dbc05eb8cd54f1bfbc52ed9cfc54101c0ab8986fc81e40f3ef2ce37d567fc433ae6de010711207cc2c98ee910b
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB