Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 20:22
General
-
Target
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe
-
Size
217KB
-
MD5
b094ceff6d937a4283d50d0dc406d203
-
SHA1
f4edf55840be139785500f72f23310220d8ebf1d
-
SHA256
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936
-
SHA512
09e158b2939dbfdc6ef03c2d0612ac2a4ae9cdaa3c9171379b306a58fc6bf5388f1f9e888b7658a6bc2018aaa68000a9e851dbcc08b67c4283932331dc69c560
-
SSDEEP
6144:urRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:csTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5135e1ef279c33e9d2f7d55a4d5832c85
SHA18654bbbd1b778e3de035c94bdbfc3c0a50d4e445
SHA256103a61f45b804cbfe7282cc8a0797e41e2014601063ef323920e35682aeeedce
SHA512069483ab3b315d17b287b5f13bde3df41b0fe265123188cad4cb8b8a7661a402b90915758be891335d3ac75910b34c5fc827a038a1ca75fe8f83b28fc833b41e
-
Filesize
1KB
MD550d6a00f63ef1b25e48d26ad9b1166f8
SHA1da619b232e647bebe7b098a56d9eae066d91c6f5
SHA256fcdf0d156bb8e02d0460f245730ce9d112a5f80a398782ba6672854e7278296d
SHA5129df126a70ba8777e22ebf620eef23aa2bb944ba1632062795a66119b877c7ebfbd0fb1ee4a0bd30071c01009947864c95c8de84a79b070c858feced5fab2c33e
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
217KB
MD5cc41976f50280f472839032678e08b7b
SHA109b42ed4baeb8b74b0b55fce4af27e6f6351bef7
SHA256ed31dc4f58b85c5f852523ff90126fdfa555785e7118243101263b160f2de82d
SHA51218c890a82ebca7d981dc4cea258cb019b06c1f65980a6c4f8c2cd5c4aa8d2d6ca50b211cf2b0fb314392a0451174a22efb0e0ad9ca92754ad8bd8a64ad4bb620
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB