Analysis
-
max time kernel
115s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 01:59
General
-
Target
14089291f3a46294ac032cb76c616cbe6e5ad7a215b6af4225a6ddd4404ce063N.exe
-
Size
375KB
-
MD5
fdc499e743db1c40692119e905a4fb00
-
SHA1
c516a94f765f5d1ee34f46ac6b3060e5bfdaaa3f
-
SHA256
14089291f3a46294ac032cb76c616cbe6e5ad7a215b6af4225a6ddd4404ce063
-
SHA512
43a8f9f192e15b255b8ad9437384a23210e3311321b70d4713e80b5bbe5188171b6027b4497fcd2514944c7ecec6dc6c2e8d4a690006d33072cf3c30a5b1707f
-
SSDEEP
6144:g3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:7mWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14089291f3a46294ac032cb76c616cbe6e5ad7a215b6af4225a6ddd4404ce063N.exe"C:\Users\Admin\AppData\Local\Temp\14089291f3a46294ac032cb76c616cbe6e5ad7a215b6af4225a6ddd4404ce063N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c641932ca4875691f50d88185544b080
SHA1a6c572957590274e61b44369d15b1df8161c12f2
SHA2562862ba9011aa34b93df4371098eff753aaa27cebc8ac4b7b888e99d0da96efad
SHA51258cc4da2b5dc5b2799a2fa3e5f6a528ce61a109707b0174d8f298a02ef3c16ada92bbf803a5978c0a5a46d9006466fd25342b9f258a652dc24bbab36f9afc6fe
-
Filesize
375KB
MD5d63361b22c84753bf87969b7502e9a88
SHA16e1fc5a440d983c9830a753fa31724d040de7e61
SHA2564bade59d8681ee69f516ea504abcf53b4b7c37983a2fb66946d6db21ddddda32
SHA5126dc9e8206ae6a849c354bb8434ba1980eff0c36dc6d188f05a16daf54bf8a48726f33d7bf6fa8a7c3681f575cf98325bb7959c900bacb1f9304e5b35fea0437f
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
728KB