Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 05:03
General
-
Target
e59277d3d95b4914069d71eaf6cca8e86167b881e5210c13025a53234aab01deN.exe
-
Size
218KB
-
MD5
03728756b48d74e4417bb6bacda03b90
-
SHA1
1880be6ab15f7ad18be1b0dfb6ed0e957e501ea5
-
SHA256
e59277d3d95b4914069d71eaf6cca8e86167b881e5210c13025a53234aab01de
-
SHA512
cad62c544893fbefd40c994cb96da10dc0d7ce6d152b094fbd691d7783b981a295434338fba0165bd7d615e33911d0b7075c1de9aca8e1ec7f8db86a6b798465
-
SSDEEP
6144:GEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:GEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e59277d3d95b4914069d71eaf6cca8e86167b881e5210c13025a53234aab01deN.exe"C:\Users\Admin\AppData\Local\Temp\e59277d3d95b4914069d71eaf6cca8e86167b881e5210c13025a53234aab01deN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD53958be44eeec9c0656f3d561e447b52c
SHA195a2e0da9d019f6053cd2c9f409fab2c15ec8cb7
SHA2568d30353c715597d56b5e945c9396f419a3ae93a3f638d86d2df9d1d9b55b8b18
SHA512a39c48b72d56856d28060ba7e302bef22061dea305d18f2e22ebb3b9ee399f5fbbf9cd822ffec1d44f2ddecd4d4255cc12627405e66bd251f37f1b8249fc2940
-
Filesize
61KB
MD5be4e5f70772e470bbf4667d2347c7c4b
SHA1348668b184670c5af3cd1a38252b64b35e94b8a6
SHA25629bc114366678a2688cef59a0a157e8356e8f1ba0e4d8d55efa86276dd71be12
SHA512dc15fe6e3192325ca1c9f3991e2873962073b52082178c186f13b5a311d78f516c2187ef686a5ca818e4e2a57e1a69d715349dd7a75e38fff1d0c0b109cb800f
-
Filesize
42KB
MD514869375547e2d4ef509aac84bc9a07b
SHA13dd2fe8700a4990804b58e8ea4d9294054288d4d
SHA256577c2eb5fc96ad5bfb0a43b301d6d5d3dbf74309a797cd93f9cbeb3bc5ac936b
SHA51220703db0db7061c011ef006bdebc6c835d3ede80daa419ab011edf98a36fc83ef4d31d4e879b43c4a1056c1537f45e5203991ae8b189aa06d1c104f0a526d9f2
-
Filesize
42KB
MD5832334462a719d429b619d5cf9f4f177
SHA1992fc8f6ca75a22b6aa871fc4d71d5456a567748
SHA25626bb735e6f8f4f10fd03138e0b509f68085f214d6aac92c5ec446c30f996181c
SHA51240aaa8160112feec1ff46bd6475c46d3441eab3c37d75bd38659a52b17b34698380115399bf89950ae473a2288bbe093b58cc96c0692f683ec1d132e1bbfe39a
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD51d4c8470357a039428892b94c4c6cc40
SHA1674ccf2a61ba591498a1d34f380af118fbf22971
SHA2561320747609c0e89ad95186dd013963c66a8b00b720eeb92da4e107fc4199ffe4
SHA512f5d59e2ff3f9bad60f8e5ca7a5e74a7dd80b36b03c834f891a1b94f682cfd5ef412789fd53a18b0b0306a5f20eca5e4916d990be4adba9888d087644c88db03d
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB