Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 12:30
General
-
Target
480059eee09635377c0c8a25350e9a0a3e03b13ade67cd78a76a2c4432aa8b8bN.exe
-
Size
355KB
-
MD5
5719051c84f43ddeffa4011c8f4358c0
-
SHA1
ca152cb4636f58fc556659d5b5af31bdab4bb884
-
SHA256
480059eee09635377c0c8a25350e9a0a3e03b13ade67cd78a76a2c4432aa8b8b
-
SHA512
e5a5e504fe439bb241a1c612da8ecf8c6f1ac878f2defa59ef94eed87204e1b1b5ec75f170f5ce04e59ea2e0ffc07ca1e21fd0cdac9a5c234132d6bcc8ccb448
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:3mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\480059eee09635377c0c8a25350e9a0a3e03b13ade67cd78a76a2c4432aa8b8bN.exe"C:\Users\Admin\AppData\Local\Temp\480059eee09635377c0c8a25350e9a0a3e03b13ade67cd78a76a2c4432aa8b8bN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51c511622d03bb828295497d7ce6d45dd
SHA1b851728f25b2d50c0668dcc1f55daf914541fdc9
SHA2565cde7e780973ec6707d564c407617d5ea3196ae824f9673fa4bfe8abf2d2d7b1
SHA51245ff1f73b48d970e84a7a2419d170fc2e099998dc90483b74516706e4c73d6868d0f0b358cda0007db6f910868adee4479a022c4a5f7cbe0571dce5ac7047f79
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5b552b2ed18b6359bafed8337aa28a37c
SHA1f8c1098c211fe1f1095953f6510e40b7ac9fd236
SHA256cf28ae53aab398724346a2dae4baa38c3193c87b3f0344b655da2f0068e71548
SHA51269003110e13aea35359d9eea14600ec522821d2c625b7a67b86122115ce47817327ea71a5946e9fcc2014c613437f1abe6faeee81af631ab5abca63258f7e3e3
-
Filesize
42KB
MD5083a7165e660d481df35c0b2ecf38103
SHA167130deba2962e65f4dd0e4928d8b0cfaeb6118d
SHA256a678609475bf45b93e456809f0d94e5c991a22dbcf305c947a7c7dc5c103ec5d
SHA5120fa1b72dfacf73f14b711145dfd50d119237f1a1a357f28a0e0468e81e6a476d3e8afcdd3b2d6ae354d3c8b1d77d4108a3b8db0b0a61f09e848fd07898176128
-
Filesize
42KB
MD59c6aa705632bb9a613ff62e4a0e3045a
SHA15caae9b60620f65aa97b59df540cfc6fba588b25
SHA25616535cb263395a531b87c5d6fb237883908bdfedc7aa0e86b27143ae106235fa
SHA512c85fe20c4efa06bd52741b01d6e595d9f1d8116a283482e3d56de8f08355c92d3c4b3fda18e2db34f0a349cf9192cde6857ad7fc2e98cb8318ec6ba9e3f50258
-
Filesize
61KB
MD5ba3c8ba0ab5b9f745898a76a11fc0e96
SHA1a66d5e43a25680d27d74bd896996c3567ee0636a
SHA256ecab1aa4fc2617f9309579b583a89dc9e3d9231d448297363ebae97d1f17fe58
SHA512bc5f8a7416111858d5c48ab523f3e6d40da6d7280c1183a86c07b02ad48d2ac3883f8c4a8ea79b22691d8f6053bee7c47399c3db8268159300db3ea06331292f
-
Filesize
355KB
MD541d4428af420dab5a3ba2660ff43c445
SHA146bd564333cf81e3f92d01304d274d062a264a47
SHA256ade291e46ab6874e846dd0fe7cb2284946d32eece28cad052127f93005d1a9d2
SHA5125c3c416ae930023d936f9fcfa810c6852adf02aa68006fd3e6d9eead1a36c8316016591257baaf7df549cc6a7c428213f8471a6ad8e4077b94ce20bd5ce28b95
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB