Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 01:52
General
-
Target
b35386b3a795125cc61283c3f135a9723c703ff55ca63f62ea1a2da9918c1ef7.exe
-
Size
218KB
-
MD5
90c6eba793777a149097b4580fd8e83b
-
SHA1
fd5314a9a53cf967f7b94323eadc8c8db0c9df80
-
SHA256
b35386b3a795125cc61283c3f135a9723c703ff55ca63f62ea1a2da9918c1ef7
-
SHA512
e31680b024980213f6c970dc3315ba2efd43377dba627c756e00edd19e45fb10cb242155fc533f8466723d7513707d42f46fcb3c32249bbc46acca4625c975f1
-
SSDEEP
3072:Fvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:J1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b35386b3a795125cc61283c3f135a9723c703ff55ca63f62ea1a2da9918c1ef7.exe"C:\Users\Admin\AppData\Local\Temp\b35386b3a795125cc61283c3f135a9723c703ff55ca63f62ea1a2da9918c1ef7.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD535901c2749607cab072804452b290359
SHA1b5af2246e0eac30c71f1ef457e2e79909f80c797
SHA256320fb5d3196d23e1985949a690834c3d12ad50dca02f261719ea754c3c410180
SHA512983b6501750e836c9689777aa1451c0a2653ea3737705b6ded0f6249660f4c0392d29be176d30632c2b6342c3e762daf160ef86fcd57efb464a4e7357ebcfabc
-
Filesize
218KB
MD555bfc6fd33cb07874b7f9c8df79974db
SHA19e2f90329de5ad4731b6f50bce4033ed2aa44ec8
SHA256dc697701173d542491a5e441c639a6589c90a467ec758290a444a7834182ea95
SHA512292c619fbeacf1947e1c4f7b43dca4f7a0570dc7830827e2675b6d886d30bc786f5496329eb026b1f1adf3ae08777d7d9a09c08f4ccba74901e88280a3227c7c
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB