Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 18:52
General
-
Target
fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe
-
Size
355KB
-
MD5
f7ec9514f3a6ca39dace0b2a1ea5a090
-
SHA1
c5bf4573a491c40b3e64d3bb2967aca450f12085
-
SHA256
fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6
-
SHA512
89c3d5f71faf86cdcf45c5d5c20bd2a227121a79da8a29e86492d1bb7bb23c3ce3f1c4abe9f71467dcede8c182608519b7ba9f3bd0d2fb6988dac81974f52959
-
SSDEEP
6144:1gEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:zmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe"C:\Users\Admin\AppData\Local\Temp\fa399ca570c9e9d05f50ad8e5a0ea7d3e886e7bacc1ba126328eebaf195c72c6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5860ae85198608b2e72c620224d41593d
SHA1a99520c1906bd10932ddf0c5c86471c56e5f11b0
SHA256c7beabb76b88c6fc0beac05de87f440333a058ccd11e02caad4fcc61bca2b147
SHA5124759a59b75f166fabfacd4aa42d7b1c59a40ba01c0e0e3488e8c16e66f235cd252fb1ba5054302cb2517838b6d0b6e1563d1f030b08e5030c1fb752ffef8582e
-
Filesize
42KB
MD52d42b475e5ad68737850d2d0dff5c116
SHA181d4ab2e20720dcdfacbf32e1734688d1db599a3
SHA256d7b02a1a04125ab369cc90c4b706430c5a5ff306921e2f8cca4dd683b0a62fb6
SHA512e5b2f87fe5fc9c9f6adb266a01423409f8f1d2c528597317725541cf961b6a6e19c0662791717c5394e888765bfc6e804355da4784226fb4004a2e727b81f856
-
Filesize
42KB
MD52bb6031fecb6170b164ced05a3066b2f
SHA1293b5a5ef78aeccd88baec7af97b1f4f1a03de2f
SHA2562033141cbbd42e598ed6d97af328c03b50b1a4d09430d930381860a392ea1189
SHA512d6f289a6262f947d53dc84968a2a1985ea857ab4d9c560273f673fd123775a41833d4cc4c0e27bd82b03df1278c428d70082fae234c347d49698145699501ace
-
Filesize
24KB
MD5e9d75b80ecfdaf538f17033e0c625fc5
SHA15ae44bcc33e13600db445b768274279f0b4bbd10
SHA256020a092683e3ac2594d1724219c35ce259c4cb1bc8f12f313f946d9b2684370a
SHA512bac67b3f695d9d600a5f4c323d068188298bff66cf51ce42297f554a52d7fa236ba1216d75a1f103682a70aea5d9eff13c44a102ed0ff06f27f2a0b516986fca
-
Filesize
1KB
MD569cfe65aaaf061c879cce40ced2a0633
SHA166ff876060c740a773b4ef64fd42d8c155286fa7
SHA256f67041fcece078d66a792517a7646b8ae0bd8dce69c704c5912c32641ed0939e
SHA51209988882377458b39e92b6a7f19b843f0d192b5a64583e4e400af0f4b824932afa0c7e4a30b596b11d5b175e6ebb237ee35b86c8039839333599a1abc8efe86e
-
Filesize
355KB
MD59804fc9ed479a1875c5dc0fe46495cac
SHA1a303678cc6a694e4154e926d3536275684660f9f
SHA25682c8bd627ab210f41237e42a3a5ac35821070bd2f293237ebf7ba02686b553ba
SHA512da9d14b858729aff3fd0a9497da0851a64d32927075fcca5d07bda18f400ce4575fe5484de96f8555e471f6fad4802f2c952b8238be1334c930e4dc6dd140c44
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB