Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 08:47
General
-
Target
f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe
-
Size
218KB
-
MD5
ef8e448d10ad0bd7e148f0115a192aa8
-
SHA1
5a37375b6d4ee5c2d946baa110e295efa47667ec
-
SHA256
f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9
-
SHA512
7ab4f989037ee91a38be501ec307f4ef13a2b756a756bd1ded92bdd364cf825c2025e47022ab78f05145cd0ee67de38c77c81cb1d541e4f0467fecce9ae145c0
-
SSDEEP
3072:nvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:v1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe"C:\Users\Admin\AppData\Local\Temp\f363126300479d74d41c75d0a73f85b210a96647eed0894bfbac450f1c2fdcf9.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b5ece37ae0b29d9bf3e61dfd62479002
SHA109493b2a3556dd352188f86874400e9ffcb0d2ff
SHA25622d39c2fd43b786232a15def56bce7b214288f616303624097b435520d24b0fc
SHA5124c5f94d1ce4a3e8bb7849b258e196a40e2d55229e3875b7e769f429372d38146a741a9ad87afcbdfcddbfe2e7cfbc87573c61bf2732a1719a23317ef9a593850
-
Filesize
218KB
MD56fcfe2e42f8f8de5c86bc631fc283a68
SHA17ade989405d8013f9984d821e7a71be42a7d90e4
SHA256c85ee7237cf391163b1762f652d4917a57c16deb590731e107e2e3a0d2a8195f
SHA5126825be3fb69fca96f2c38cb776beebacaaf6682df146bf1965d5abe3c86bb42bb4651c76ac1fe32efcfaf02ee8fbcf3745045b1377d649ff27d4d2717d6672f1
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB