Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 12:49
General
-
Target
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe
-
Size
208KB
-
MD5
3f9eca2b1cc7860e700bf95a05c96bc7
-
SHA1
7786cc432beddfaf763f2315cb79efa67f863474
-
SHA256
6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88
-
SHA512
8aed405219887e6470b0196adef704f9e9b5369021e181a9e6bb495b51e859b7e4d10b50c6e335ed2724da04694d3bf078df778e8c6fc0cedd7e597ec2f26c8a
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkQ:ybapK0JCmRcU9vVokfr
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"C:\Users\Admin\AppData\Local\Temp\6f7db2a0beed468b3609ed43d68138e7ace09320e911dbc6f61a73837d58bb88.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD56a7ce327fbc19801e55f2f69396f21e2
SHA1da63189c8d57f2278cb849b30be1823a889e7a65
SHA256cf52a25a51f0c13e20d99c2cf2ad954a95cbbcdc05ebe5bc250a973a00a8565f
SHA5128e7cb1d0cd4f13fa573ab8dfdb150958ca76fca87866c4fda2c70bb896eaa22197552b53aef2652c9380521a8dfb8e5a862d6658176fbc7e70894763aebc2f74
-
Filesize
61KB
MD5744fb7063ad543f4ca5cb17d69826d2b
SHA1b594637be7cbf4ef90773446ee4e84c62df86a5a
SHA25624c5fb01902be11f28eca0b57a25fe829d73363f4a812e255972bbd6f638f476
SHA512ea5684da7af4239910af0eac73c8de1d413369e1a8be2fe9341d10782d7865c428f1e79edea4189e2ef638182c7b1f65c9b28c6d53fd5239dd8b24914964c6d6
-
Filesize
42KB
MD5fa89a8cffe652c9e4041a5058ac709e6
SHA12e0c4c1f4f4b81826497c37caca329bd227ae6a5
SHA256867341883c3accc370176cc9d43a6177ca541c83cbf3638caba6f7914f011df1
SHA512540c657a02ba4117abe86db8ca0b50ff8a6beba245aca89ff51ed3433b3fb63fc2527b65103df7af49cb07409963c65b60ef8d22a0e1b6d47a92c81a6b844957
-
Filesize
42KB
MD5c19045a835c02c51f2e6a6dc167c2602
SHA12f8ee574e3e1e1e1cb57716acf855643c418fa69
SHA25622568124e58bc8c63ef7669488848a7a2f9649fa95e483ae1077f0fa615fb349
SHA51247dc0d2d05d6d89ded2a0c18d687b4b5f2b0e355d9aef74a6368465d408a0d4c7328f495bd580610c952ad1ea4578a96471910509e61c8b8733f27ddb7a0a8e1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5c5b610af393505b3f3567d3486f369c5
SHA1435a4fbd5b6b2cbd7222b3e15b97021fe5b213db
SHA256c16609d55f00715eeeafb494261a0057ea74e03d6e547ab71edab768b13d701a
SHA512551c6d8f7b41b7294480739ab7287e05014d5359c9988f5153af64daaa526b82c3ba8c39dccfa9aa9d024e67d1b6df513ce9dd69a67d9ef6c59f1163af6c06f3
-
Filesize
208KB
MD57b5f5e76b736e6516210524f0593be02
SHA13b478bceb6a756abe44275c0c3698c2a4de09f32
SHA256368238186f54d7bd8883557b606784cb75cb630f0b15a72c25abc588745682d0
SHA5125708b17ab96ac8cff0bb845923bbfcb6f6467562ea63364cf24afc7b7f8f5a5c04262550fd9e73af2c6b7d3b306b4de7cf58c4fd6a047162813bff34ea672c43
-
Filesize
380KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB