Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 17:37
General
-
Target
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe
-
Size
204KB
-
MD5
4aaf45f1e44e8e680125294ad8315ba6
-
SHA1
c986ce523190e808e6b119d382f3372b34c86d8a
-
SHA256
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f
-
SHA512
42e9057c59ed90dcdb2d78a5729910c113cbe9fe79d63f4aab83bbc59446097ae4386c2606d084b549bb498c88ec2d7bbbaf9b71cb0f1a3873fb0cbb1825e1bd
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAg:mLexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54b715d5a6d12a07c841f27b90bf6b7a3
SHA1f47a61e9d6a4898cd5e4c906ca26f070d00e2925
SHA2564ebdf55ff1245f8880ce47ba157878d76c0f6a2c8d83ee7db7d95af6d8ec1fda
SHA51235e5f3a4d580e5ea833a0fd835862e2a85f25eafc41905efceba09cc5f9daed7087c5f989ce893a5ae9f685159c0dae52cfd69933eae080f3c95e28435db16a8
-
Filesize
204KB
MD58baaf7825d02c627a7d79f526b719713
SHA1bb953cf481f12201a2fbee44973e8fef7d30d234
SHA256df8b0ca9cd57754182044add5eee72e3e8e2e503c83d640794679b6c82135399
SHA512280e4c4218dbc8ab7c78fc65baa50b31894fda3840ee8c301a523d00da88ec4b0978c40c9b8e629953f9a6e6698004f4fc7537a736ac7c3f1e527f39de43eb7b
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB