Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 22:35
General
-
Target
dd9131a2e6874bb60bd267ed1eff39f6782777d5d8be9d4c79d5565d1bad3c0fN.exe
-
Size
208KB
-
MD5
b6a561ee6212efe7cfcd6d8c19d12ff0
-
SHA1
1912be08c6eaa3a01be766ef0f4eae41c209ff90
-
SHA256
dd9131a2e6874bb60bd267ed1eff39f6782777d5d8be9d4c79d5565d1bad3c0f
-
SHA512
16adb13fff567feae3cf54e6559454b35c0a4b60f6016aaeaaf10453bff6ad6c2404b3fad46e800b50878995ad31afc8849ff0df8bd959e1a62c63151cdcb2d2
-
SSDEEP
6144:qa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:qbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd9131a2e6874bb60bd267ed1eff39f6782777d5d8be9d4c79d5565d1bad3c0fN.exe"C:\Users\Admin\AppData\Local\Temp\dd9131a2e6874bb60bd267ed1eff39f6782777d5d8be9d4c79d5565d1bad3c0fN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5236c84a620d92469dc7873c5fd0044d8
SHA1399579338136d55a3c6e17b188b1c7725e7a20ad
SHA2564ae60ae7d47a6f107ec76dde12993de8e75f88c1d6255b751df4e9dd7276de97
SHA5128549b5e078fbcc50f0bcdbc2e40d678abc3f10adca87b34605a8a968bf11f7f80b11f7da9975432a670fb993d16202ca03e85ba6f0dd825a302ce3df01392d90
-
Filesize
208KB
MD5aeb11fcd513c00b8f9e39c52e2409008
SHA1456282945643cbad590c15705f4ed750598ebe04
SHA25660dc713fc52e964a5b02a0780026c8c1091e4bb796378fb7f02624f67b1b13a2
SHA5121d5c3f3ed403d8bcbeac323cd6357999bd5e1869c38db963084449a5f4a97ac9484242c7084bef1709baae33e3f43003c3be1a75d801b61a5df8169f83a4fe39
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
412KB