Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-12-2024 02:53
General
-
Target
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe
-
Size
208KB
-
MD5
1ae630c9073650cfadaf1ce8a2500ff1
-
SHA1
f6719008bec7a1f9c52557f3ca6cf5301dd0ae35
-
SHA256
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77
-
SHA512
07ed34719dc16f95a13a928cf03fcecc8f375328caf012e4e399a1ca51eb0ec4de01c24cf8cd5c637afa9778b3c4534632a3e39c2e95161a792304bb3043e72b
-
SSDEEP
6144:BOYX27lPBA3YDMw4lj6idlMlwl7/79C87A:BwBAy0rlMI5i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
61KB
MD5060e21842d82eb84baa40a04662ee8ea
SHA17c37345b19a12afee0f218c4c6a33edea4c5f5b0
SHA256d6749578f121d7a780ac34134682b89b312ac7480f775725f159a53e4dbb3665
SHA512aef969bb1bf4fc7f40d6a6952a70e501a5047f739300e7d66843c965dffc95e8e221ded8390124523d3c8816de02ee3351a266b9da5a8f2b2af85b95bf4f9def
-
Filesize
1KB
MD5b21d6b22697f09cb3cfa2a357235889a
SHA13202897d0cc6b76fdc154e14614b8047a8e80880
SHA25689db29d393ac2d19de64a5bf173ab49c829fa55eefd1b383f3ae83afc15ec7ef
SHA512c8e82d60b183f17b7c758486710aac667b200ab223c02f8b0bcd4949460809db03d4e9ff16d42cd0821093361e51b926908aacce7fc8e049782a9d305514adc8
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5853805ca0e7d68b9d16d4ab28a020739
SHA1073b7020f2f9bdc1daebfa09f0556aa481163d8e
SHA2565783e12e79b424866cad488f04d2971a850d67a70d611f26b233e8e8d9616c9a
SHA512281c8b3382f5c2fa6347a6c792e00f024edc30a74ec68fb087205b1137ce659b180ba468b13826ea53efb54047648ff81c91b6d7ce8310b27464a2e6b752deee
-
Filesize
41KB
MD5886f1d0750455776967a083f1d386547
SHA119a7b688693d71d64e4fe48a69fde1b56fb36881
SHA256cc4b354ca2aa7e19b35ad9070789db6b1328c241133890d0d1fd6511d2673c53
SHA51257eb07621e33ea44ebcc1256e8f761f8ae825f5cd34600eb4cfef076bbdc0f771877481b0de556d13c4e7d5a55eb5cb81d2135eec1dc1b5948809d2e133676c2
-
Filesize
24KB
MD51041be78184c8beb9ae72fb47ddbc5cb
SHA133ce1805f964793f1e6c388fdb48b97d2b828b6c
SHA2560dc1fcc49f052f5eadcd75cb9197288a96d562b6f5f5f55d06789151e5cc9a52
SHA512b4dd7c4ea0159d493961f40c527192011c27336b5eb7677b36b3b5be10d747c0b1d65604fb5319db51f4432ade9a12fac8923d693a5141e24c611c4eb94ec596
-
Filesize
1KB
MD5599b0106072d84ad723fb71fb2dac5b9
SHA1d7293565938117b29f6c416f83345bad5cff2ebf
SHA256bc1dbe53a2764c35bd09844209154f42de6b92f37a744b3f94e146fb2396ff5c
SHA512bc99933016806a1b2c9009951d07e18e9fc89f383a88e81c7929cbbdd8670e539995dac6ac5ce0d98c2f2d40b00d366d2fc650465f1e9e456a56b1d13801cec4
-
Filesize
208KB
MD5323269aa7d4f77dd71fca1ceaab836ec
SHA16add6ea61038db8819414419b9b36c2f3b9856b7
SHA2560048a5ccc8515fd55f8cdc17b27bea496bb104d2e6fecccef6d4ce2ed569dfe8
SHA51238e98cd38447b67693818c7ea8dcc1df72777e937ce89a8b3ac86ced796f8a1a5d1c9f648b8141e87898d20307b9f71502d5f11646d45c591286ef902f6907c0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB