Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-12-2024 20:06
General
-
Target
1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe
-
Size
218KB
-
MD5
5371937f45ef141a0a7b34404ddeb508
-
SHA1
2c57999aed57290420fe7c09a02a8f9c7f7f9d39
-
SHA256
1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456
-
SHA512
f6c6739f3bcd4674153fbb710fc816fa01c4a4b92557917c3d04394647768dd0f5757cd22a11e49ec4165ca8e9adb50e94201f5009e91bff41db5bdb06fdbe64
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe"C:\Users\Admin\AppData\Local\Temp\1660e4e137fae3a352e8c76a53e8c49e7d9797f76a632f37bf2a36af5c33a456.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
42KB
MD5c0ec691d3639ffde4c9714a093c87cee
SHA1af57d9e13e0db539a14ba46e209b5cbe6969be84
SHA2567f7c144109721d4b65312a50ad10d67d7a30caa386604f9a60237bbd3f94fe13
SHA5122dcaf4e9980203f27dc744e80de4b2b8a2aa5297726b7a97c678fec4f8c96870e1827c1e68d5ed72838d9f3759116e41d0933e54f3b3bddf98cc51e21a06aa0b
-
Filesize
61KB
MD507493455ceda7a6a2299a4fc613f268c
SHA156012fa6502e190106030992794a059ef39e64cb
SHA256bc02dc46bf5cca06ac717baea11a94abee342ffeb48622704c7b1f518893e15b
SHA512a5c1dafdcc3ebdbf146629b31ff98d727cfe1ced17be8a90908ef9bff75ed57a6035d2bf942422033d15e88974ba0595fa4f6cbfaab3384b41db3f55ed7e3b29
-
Filesize
24KB
MD578fab426d4a60f1b4bd395efcaad0c0d
SHA1871de114b1a8d62cc2af04bb4d494accd5d0d628
SHA25625c5148096d2b3a1a3529290f507a9e1802f526afd485bb1e00eff789f56c9b8
SHA51251363de3307aabdd116853050b6003746118470fb6cd3dc6a0a784001a374613b2e2da3ef7903659d622aca1417b84f154f2da957edd27742e22875eda952085
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD55f2349975208c1aa1641ebd5a0dadfb2
SHA100c5fd3246291665aa5cfa8c4b107b3b4e0d6a13
SHA256f717382db3876573cb37c56a5b8075a26beef0528d0950d9e76471ab40fbdef5
SHA5123c2d13c415b56de56acd2785f153fea7ec02a7e56c437ff339c2db5323dbb17f3fa99f9c7fb3cce23d728806a9a53e071a6d58c1133572c35dd7d83e47400651
-
Filesize
61KB
MD533f1c65b78d380b71a9a0051150ce17c
SHA1ca6f7fc5285b0027db8238001bdb39a2c5f5dfea
SHA25666aa247953103354dc76ae842fd8227051781329d09f6d2566f05158d689a54a
SHA512844372c246104da7dd018234c3b01791d541fc881de57ccd28f8c65113df2bfa37fddd59950f1072aefeefc57f10cec46206867963699be020debbf811566308
-
Filesize
1KB
MD5c89863abf5791b6cb03d2aaa15759ae2
SHA1887c7d287aa6275958625399eddf1f8fa3f54047
SHA2564755a37edbde5490f58c0a44107815f2dca06a2f2ee90aadc5fbec05a97a88cb
SHA5129d24f507e40ab639ceedb14ef09b04db09f5efe50b99d2b8875ebe21ac956e7667f30cd49f1602fc4a997b7c6cf4aee65c69a929ada50123e2697bb9b2bb7d12
-
Filesize
41KB
MD57deac6a3788cdfc311bb6dd8a5f1a5d0
SHA19e173678fd7630fcbb0d82556f6a5fd08e623f72
SHA256d4ccfd7d1d74d03cca3422cdbb96aff304023ad4bdac5ea8543c359240724bca
SHA5129abab18a098a9442deef1fcfb2874ade5440831cd5b20853890fde92e894f7d31bc956cd21b02c7c86eea1b96d04d90367a837b5172ac5dceacdc35df82aaad3
-
Filesize
218KB
MD58aaa06a1c1b76731c2f0d3d44cfae4d9
SHA1bd994668a802eb36ff0663f46766e2415c2eac5c
SHA2561796dccc307636a86b314c3423ff7b06a58fb3420d85d3cb7b426224dc54293b
SHA5128b856c3baa9c4d42bd90ad72b9964fa3d1b0814c691658a4dbe9e9726448ed07fe7bb8757e697865553d68e77b7d4e67f18456532655993011187761f92c06ff
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB