Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 11:02
General
-
Target
e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe
-
Size
212KB
-
MD5
306ac6417922cc5b932d5401eb00159f
-
SHA1
0a77c250568174c170d783e5147dc506d32081d0
-
SHA256
e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109
-
SHA512
5938a4574d4f477ca9279408d676fc6588a6ed4735d8cc159db7cefadfb67a981899c9b741f87f68180a86626303e63941c8c581159f0dae54740d69c0ae70ff
-
SSDEEP
3072:aGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:aG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe"C:\Users\Admin\AppData\Local\Temp\e3917354bb237f0ae4a27edec85d65c7fc4c44758e2de2c743b638270f357109.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD55900bb56a011d913b25220bd88fcce36
SHA14f26a99eb8dc54440507c449d243e7be5bad81e5
SHA2566ffa8285a207c9dd121b81d331d518c8420cb56e15156a6c10141eb3624d4e31
SHA5120333fcfd8d1b9b8fcf0e33a2c56f3b76a493b427407002d9a2c07c19933371c76ecf0619a8cff7690c17a9df9f5021845c6f4ac42e5de7a6fa4024c54b2e1fe3
-
Filesize
42KB
MD592adf86f44adda9f0cfcdf5e333b88e0
SHA1b5d74a35720e44960a65d7d955cf486ca0b2bc23
SHA256160b3170658b468dc764913af66103babea23a073b58076ab6c87bf957017227
SHA5123c2727c1fb13494771b91b1e8d403bd51fe8cf8550f51a340f489dc83100a58663e17fdb5cf8e16f6a9a1bfd2e63212fd8204989a3d07a9ec2b0cfcb259e74c3
-
Filesize
42KB
MD5fa38d274f3558705d3ea79e5e3445657
SHA1ec53f25713b9d615f1090900868e95476e2c0031
SHA256a85fc00dab65c0e076e1bdd20f4f8ddce716200102445b827674ac0b6c6dbacb
SHA512416dfe3a5c8077da8f4dc898a5d9f84049713602a9afd4eb90b997883d988e4d1b7d6f514856f4bc8a354ed55f47a6c6ad2db5212204211bc7f02ddd9495b8c0
-
Filesize
61KB
MD5817b1af41042a1ed3d7e771404c4ab5b
SHA19d2657cf17eec8daed1700df6854762b2dc5e458
SHA256487a5c54b76e12f17f2bd64937623a813fd8c778ec625effdf0724e1103a7d5c
SHA5124d6f64ea6e14db52250b9e927f136d8e1579798649dc5d6f7ca625970cd5e44bbbe55306d4740818c1932c47f53c85614c2767ba75db85e2b77a0106264b7c98
-
Filesize
212KB
MD5b42051e63853727573f445ad5af42c07
SHA1ddd79119fcee63b98e50f90d67a6e7fee58ebe1a
SHA256c244f6909134b2f80bcf79415272c39d678db2c9c48aa5278289fa78ce9a0ed6
SHA512b402eb090ac3eddfbce5a127bc93a9f11882bd058a34941b02be0739e028237e23aec2442fac4585ad3b5eaba8d29abd3c546664d740684f8231570b866313d0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB