Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 02:07
General
-
Target
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe
-
Size
217KB
-
MD5
0ec4e7beb77023e14bd5a4c00903efc7
-
SHA1
3d7ccc8483e0d4f537d7f7e40c00d11fdce6aa3b
-
SHA256
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4
-
SHA512
3975d018a9f616bac76b36659b79e26d3477a2dac5f4e1294e2992f6a5899f5c26b5dfeffe4bc9c60e2af7e40bb4c698f36237a8a120b5bf9d02e9fa85629cea
-
SSDEEP
6144:VrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:FsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD54e31caa7885f9f180ef5435f1ec418b3
SHA101c7e2399f381e75404fecb27f09098343918eb9
SHA2567ba613a1f5a9786b9671a9328c9d84577a10d8d0ddc215264c8308e09bb5871a
SHA51283bcebf79ed201945a17fa27bf7117b3f3e489506bd625c95fed7f2d4dc67d9a2105b4ef365fe06f7724ad3f9c7dc4d9818ecfd25f7f5925f09073db121fbde0
-
Filesize
1KB
MD533e676d8367566d1288df9bafa9808a5
SHA1c9ff28131a080bdce6c17badd9340934aca5506e
SHA256b5f40827cb9e54a9613d9a5b809864c24118ea301424074ca23c9aed97e43efe
SHA51291cbc976b52831097914e3e500b3922c79c213b27aa0e9128c8ce79a92bca270cd1f59c93c0ecf66da4fc29473d8e8009e3b105bd5e7688a472b982eb60624df
-
Filesize
217KB
MD5e71563576d8bd92ae7605b5802aca99e
SHA1e941ce9f48748c39cded7d7903d52bc7b85d3b23
SHA256fbc43b8c3d1cd413b4001af237049d35dbf106608699b534c1b6783add7d2367
SHA512977da76b19440045947b7972d54cce8df845581094469e679d03d10edc357cd058d61457114de76defca5187ca0c15acac1fdadcafc2abefca5100bde9bf295f
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB