Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 02:08
General
-
Target
9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6N.exe
-
Size
355KB
-
MD5
9980660679e50998dcf638657fd81080
-
SHA1
c66123fe98f1322b66a7d431c3805e15f3aabea5
-
SHA256
9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6
-
SHA512
76bb728072b4f99bea77905466c53406774b11fee7e6ad7cff3af5145e10a33a67cff9124d53af5e50caea75c04a4be20a90a56a8ae75054d4728354cd18e8e2
-
SSDEEP
6144:L3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:omWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6N.exe"C:\Users\Admin\AppData\Local\Temp\9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD552cab5ab807d50e50df7edbd618eaf07
SHA177eb6d6415262dd288bc6cc177fe742a5a76839f
SHA2564bb0a28e5faa2be8ad470eeae51f96996430975b8cf3f51f7fd41c0469dadbc9
SHA512e585299f4ce0cdcb751429063ccf29a7253bf4fba40cab2d0a99ef83b84b431f09bf313dd01cb8a0e641838861b4f42af9b5c813371bc28e28587cda70516d5d
-
Filesize
1KB
MD52c370619d3b5dbd93ee48829380f734c
SHA1af4cab2918cdc080dfc4618f0f36c0deb35871e4
SHA25685ad3a10e754fbdd5b18aa2431806dea61a06926e65b8a81756e8dc25ef7800a
SHA5122999248b85efd6f8a9a5ae36bdf1814c9d0d8d16779db0561839b68c588c059df91caf7b5d54b7cc5984eb50af4b791e69e1bba68f98100686223aac872c3691
-
Filesize
99KB
MD5396866772b764fcdcfd0386b7dba630e
SHA177a39a1a139f80fb0ce299fd9f81161b12f092e9
SHA25668780a09d76a978dbb15f75805fe901b767aecd836ca8d655a04add49618747f
SHA512b9d3ecae0e13f37eaee9ecb94302e2154e1fc9dc963704042f3c5d2b35a22d7ec48509dc81f1e1f75378ebe60321768ab50f1c1b4076b8ea4b4a878e16d73c95
-
Filesize
355KB
MD5c18150e198a8743af0667188698893f9
SHA1fa8c5bddd5dd4a1bc98c2c42eb986d5d439e344b
SHA256c6f23a295b42db93f8345404ba2aad99540d06bd8e497ca2df5b9d2c98b114cb
SHA5122bba88daaec4a0f2baf626e10533e095078a8306a44a000761069a6ee642fabfeff9990fc78c1b0fc6e6c4070949704eb5e30162a1a694110434c248dcc59137
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB