Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 01:04
General
-
Target
9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe
-
Size
208KB
-
MD5
37293c23e4d2fb6cda8165c77606b158
-
SHA1
e21c2891ef9b4dee74e6014756030cee0c2ba2b8
-
SHA256
9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373
-
SHA512
633e5b5aa6607f5b6990d3e0bb5f126300356dc9150647078081893b84b522da0941c6721332a5e213950552d78d1f2b1d375d0f7f84defd3cf832fb61adaa2f
-
SSDEEP
6144:Ja1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:JbapK0JCmRcU9vVokf7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe"C:\Users\Admin\AppData\Local\Temp\9a5f7ba91c5a4e4a1d3514b1dce9e71dda3d84a78e42a4ad4dbfa78dc7120373.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5102ae1d680e34c4c037fcbf9b41d096f
SHA15c075d56cde2b276a2959e9e6cc44f4d6e8be50a
SHA2564b527183f256754dcebad8250179b5242addf0f39925a8ca25d017a33f78b1ed
SHA51206672c6d9892a22c6043f34b721effda07ae417170201746a841bb9e9bba9849860d391b266ad169db74e6a10eba6e883fd0168f75d0e0410385058019dd2806
-
Filesize
24KB
MD53db4e70fd7baf8372b0d6115d0f4c9fb
SHA161a928fa17f1f53b1178a40a1abbbee679ca55df
SHA2563b0833dad9fd5e273f5e887cd7bfb2a48a0deecee2dbeb166ebb0a1614f1d73a
SHA5129162be7b0719245131087d15e92806b57cf50fd3a22f39e17f87006606d02d32611ad6e9d54c9be5738bc7c4bd7d9b643256d53f31508c034549ac59cbd441b3
-
Filesize
481B
MD5cda837211bc80f6ef8755b206d1fc2da
SHA13bb0509a19e245b7a5ac2543a7a424c9b4ba8c1e
SHA25610eb93229cdc78a51913cacbb49462f7f785bd2dd04b627edf0a8a9e04a06f75
SHA5123667023f9a1ad17ec41417ee17a42083b17146de159e3efa1459cb6116dc401b9b5387670932fad2b0fee8faad2a7f8041acb552a2c81a7c80179fde417d27f9
-
Filesize
208KB
MD5ffe6f0cc51a3e8e9d311b854392741fd
SHA1b89a74fa992a043631924c9534c42cd2891136ed
SHA256477f6da616f2229b3598dd4ad97b99de11e314ea7c2088a8aa1c4813af0ad301
SHA5122988dcb03d8428425f8788d5d43928b14548105abd6a9d07bb2a720c3f0dcfdbe14a284712547605800b1887d0b543eadf90335c509ee31b884577efc82b767f
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB