Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 06:08
General
-
Target
1a093c972a63e721392bf263fc9de00b9d1e8b763998823201f61e21849a6b74N.exe
-
Size
204KB
-
MD5
a9787fd8e3b97e61ce44cb51e0356180
-
SHA1
a59f7a2e9e7941e802a167ad28f48ff82403a48b
-
SHA256
1a093c972a63e721392bf263fc9de00b9d1e8b763998823201f61e21849a6b74
-
SHA512
b19d3cbbb628dc2e31da27595331228ca94a2eec0f8c959bd622c8300cf0574aef3bea4a0a67c1fc01e10f854380524fb70f058db7b32ebb9bdbf4f4c118bdf6
-
SSDEEP
3072:n5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:nLexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a093c972a63e721392bf263fc9de00b9d1e8b763998823201f61e21849a6b74N.exe"C:\Users\Admin\AppData\Local\Temp\1a093c972a63e721392bf263fc9de00b9d1e8b763998823201f61e21849a6b74N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD596049e21f2483332c7e199c90b181be5
SHA1345cb55ca5da6aee46083133b2985fe0cb0daa8b
SHA256b291df2e1e1947c9127c2edb9ba9b547d1fb7e9267ec81d197e834973213d175
SHA512b780524a93d0cde4b828a2fb58fac890fcc0d088af3761ce1f6efe39e138149b8ba894a1ddf2dfae2b47cfbed2a2ccc1cc92f77c7c6fedf87a521d9351427e96
-
Filesize
42KB
MD5cda6a21c0dd9455358c0d6e5a9706627
SHA1e5c4735bbc095fa3e5045c7bcbeeb93d738a348b
SHA2560071ed6386beb37766f57a27357b807e4997ab51fa58c61ca76423c3cf6b0a58
SHA512ddd0f17848656a16cfe501b9db58c52ab3d3254ede780616aca253ce3b052cfb561d47b815cac8857547c15df97374ef6dfb5a6cf99707f88fab409f031775ab
-
Filesize
1KB
MD51fd67b1270aa34805a98eee401919645
SHA140d5abde604779361d2d940b78b790f8a34493d7
SHA256253e2d5bfd98caecd3098004378e853bbbb4eea37146f2af4b95c29001d1a479
SHA512c4b5a33b4afb221c2f090a6d8095242702c5bce9bd7ffe19eaad1040c6e171a6e180c97ee36d6486a4a993b03507f3b996b09cbe5bc510d715414efb92b0b6d8
-
Filesize
204KB
MD5036b123c231f6e9da293922d787a4395
SHA1686ca041192aa68d6d5a12659ce6e6744c488c4b
SHA2564af35f104c54a9ff020f90fbfbe07536978e38ec9db08c15577fb1d43609ff6f
SHA5121524d6fd8d4ada9567e259ad73c46bb5c293c6fea1c319ffb6c9dc280912531192f9879267eccbb4ed9923e68ed9b2085b61d43c70b7e75563f840bd29555c91
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB