Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 20:30
General
-
Target
315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe
-
Size
1.7MB
-
MD5
adf59c70765a4bf0d1d9c0e5bf5e1d10
-
SHA1
d0defb6a3f4badd8080ac997f25b9d06633a9b0d
-
SHA256
315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7e
-
SHA512
e472ca43b2b9488dddd69e0c5a7b4caed41ade2e2eefe004022c42c6eca20c31f77c8118ea752bc5507843f458271f3256b22f9b76377e9d1e433b2a751b9914
-
SSDEEP
24576:TmUNJyJqb1FcMap2ATT5rmUNJyJqb1FcMap6mUNJyJqb1FcMap2ATT5rmUNJyJqG:TmV2AprmV6mV2AprmV6mV2AprmVG
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe"C:\Users\Admin\AppData\Local\Temp\315318286c2a85dc68d1104234147521718a25316947489278b5f4b584ceec7eN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a51623ddf93517c5c4713d3562b8c630
SHA16f9f1c0f3ad7465d30461a87eca3fe0a3b020396
SHA256bd3e11458f3cdc9292e047bf19c01e87362d14e52d3e60be1ee7c0019f084d09
SHA512a0a7504bffa2b74febb93640d92cdf183ef9329b6b8fcefa06e810200e0308f0a0cc751bc5661deeb5a95b4733441ba1612bdf6829877ec35280f7ebb7b9ba13
-
Filesize
1.7MB
MD583d88c98a50dfbfc796a0cb39025fef4
SHA1999c656e100b06a264af90c5ce4f8178cc3e12d7
SHA256f4b5aec6e0c44479465f9c808bec2cc788de8171570820e93c415ad3c38415fd
SHA5122ac55420c8ddc1e71c5d99dead5ed64649b12a4bc836850e0f19326910894a1a261714ccbbb9dc8e9c7d0ade78d3c272498965da78201e446d60f4d71b5c2acd
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB