Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 08:19
General
-
Target
b2a5c2fdf175364373633fb1e9c08f667066c8129fc3fd124c6ff9412c72b18fN.exe
-
Size
218KB
-
MD5
4237585b0d7fe8a710afe66e1cbbdd30
-
SHA1
7d0adc7af394bb76244b0ea580d05dcda3ad048d
-
SHA256
b2a5c2fdf175364373633fb1e9c08f667066c8129fc3fd124c6ff9412c72b18f
-
SHA512
386e917e5c7dbb99c640ed251f24cff5a525950a16d15eacf1f368d9a0bb8a84758ea0223f08cffeb4abcdd64de5075168c017a2f996996109c369847e3dbf8d
-
SSDEEP
3072:avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:s1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2a5c2fdf175364373633fb1e9c08f667066c8129fc3fd124c6ff9412c72b18fN.exe"C:\Users\Admin\AppData\Local\Temp\b2a5c2fdf175364373633fb1e9c08f667066c8129fc3fd124c6ff9412c72b18fN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5546c1d857c0134587356a5dfdf57ba3c
SHA1088661224ba1c2e81a36fd8d8e02a445da2025d2
SHA256475af1f5cfd5a771815e2d15a7ad2870b8b599bb43f89c20fc7d64e6e1cc5b98
SHA512f63f9ae499d014f6d4a981ec7b3bc7b71ef1e25ce8f8d20ac3a9372585a1abd96f26833981db89b36a9d18a285ff1274b91964735f8f64160e93fdee2f291184
-
Filesize
1KB
MD548e0c15abb97fbfb8a054d8f9773141c
SHA16b460c1a31fcfdb79708c6e5b6f09ca621dcf6a9
SHA25611aef58a5f83bae3ffe36bac46e22431131b0082a33bd0b4b9c3392c39d3fcb7
SHA512287991638440efa29d6f1ca7bb559404f1474e94b4435d19bc0374c44ad0895ab0c2d82f72124144a68537e4f58bc62e0a20687a7b1957ef0de9cea5e43bbf6c
-
Filesize
24KB
MD58b278b2458035011bfeac08e0ec81251
SHA147d0346a2e4b3e1946f3f564ef6ae037c65b2bd2
SHA2564ed801ac73f9094aa8b75750784327d03a4c1fdff22fa908338835194bd0b4c9
SHA51271f13eb62965284704f6738356406e424f05c8c99e6fa643cb807a522af968084101513ae959f608a7e4770941f1ed87079a71ee2d37e912315b1859d806ce09
-
Filesize
42KB
MD5a5277aad18776ea76c9ceaaee7d541d3
SHA1abb57634919a340906884455a4f593865aa39f19
SHA25672b7e45e9dbd274e539f842fe604d3ae72572b72e452d2ac6e74ebf70e607e23
SHA512885daa7e60c235fe546cbad64168976cd5b8da983599baa61dd08a2d5f7f56a05cceb2030d70b4ce3484e49892eb54146f628aee4f0debeed924b86f103ca5f0
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD509b0e97d9b08d52d9c9799f99d631854
SHA137064444f0dfbdd2dbb84090fda1e5ad5d3fb7f7
SHA256a95c275b09df393eb5a525f6936a96520cc7c6415eea79a07fc4ef27102d8827
SHA5127540c1382dce47098280ac19a3cc623339ef2b49a31b3d3701d39bca8aca605767c5092733873e2bd247ec7e803527d38a8da54f4fbed7d4206eb4d02e314b64
-
Filesize
1KB
MD51c25763ef6ccb99da55605887fa46b1c
SHA151ca38a9ac41e80b64713cad94eba21eed51bed8
SHA256d5ebb1826f5f6c9bf350bb1a9a5ad9d360d419d95697f1dbbdf9fcdc57cbf821
SHA512731bf0f19ec52722190ab037c914cc7811ca64f2d8de334f670486bca22a27c6e58bbc37f99e5a2f8189e595a9229fe4ded4820be583e3c6716d9ab32d75b470
-
Filesize
218KB
MD56f5273e86b2b9d6cc8ace142abf8172d
SHA1fba48a74c91fee443433a4fdb579efbf572f50ce
SHA2567e7b36510fa8f562131a4c9f9a9c7a0a5c00004fd65cd80a3c46bf4c501bfe92
SHA51284a414e2559bb5955c091d54edabfb0274a8605b0f102e0b29b68ddb45922acf7b8e445cef1c80d62ba0fc9806ace6c2d53f37ff2bc0a8da3bdd62ff8fefa844
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB