Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-12-2024 20:01
General
-
Target
5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe
-
Size
218KB
-
MD5
c28621729b845cddf4cbb4027a36fb40
-
SHA1
2ec844fdde08ba6b283825bf50b2cd295c953c48
-
SHA256
5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9
-
SHA512
916e48bfca397e8dc8e46c79818c34903146f1182b472f12d25ffbebf7b19229df718bf9b17a0086cd5f631b807cfad72f5128e9152803b032a710f640361019
-
SSDEEP
3072:Tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:L1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe"C:\Users\Admin\AppData\Local\Temp\5fa5f60a934216bfe48c6ed06d118d3f5ef13b271af34d9a2594107f62ae9cc9N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD589bb04fb7fafaa76301f582cd3a3379b
SHA1f468e3e6114ded99cafc54055960bbe6641cf778
SHA256aa12f3d12d709bbaae78f4bb24cb1c97142c3a01e56f4cb93a85e9d6581987e3
SHA51271082efce83f3852fb0dd01d8c3b77d8ed48be1c5dfdf8807678fc1fcad6a920630b5ed44cd206bab48f0f962f1047e7a09dfacb458f9daf907d4c8606515e0d
-
Filesize
218KB
MD5cfc6e72e1eb4338aaab691ccacb9a121
SHA160fa0333782464f8903ae1496187aadb4ed66e91
SHA25670445d2664a0dc6391a966f04ac88b5888c9e2df61891f15f86c83e944c56fef
SHA512bd03456c3e42e092ef8556b11ffa9e1fa8c3211819bd9fda8119fd3b5236fb1630e6a739f01f06c8468f9ffb9e6a7930942797516fdfa6f0601addd1be73d7e3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB