Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 17:47
General
-
Target
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe
-
Size
204KB
-
MD5
4aaf45f1e44e8e680125294ad8315ba6
-
SHA1
c986ce523190e808e6b119d382f3372b34c86d8a
-
SHA256
4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f
-
SHA512
42e9057c59ed90dcdb2d78a5729910c113cbe9fe79d63f4aab83bbc59446097ae4386c2606d084b549bb498c88ec2d7bbbaf9b71cb0f1a3873fb0cbb1825e1bd
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAg:mLexkuRaX41xoyJV65gzyZko+ucZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"C:\Users\Admin\AppData\Local\Temp\4c0107dd1b3b32ab92603db55e669696b891eff7f2c444d34c7db7a6ee39ee6f.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5642f047128fc1fd68ee10f89b98c5a0b
SHA1a5c32cf061f23598a5f486502b543f60e56ee67c
SHA256bf804ea9dd4ed4c08b495e1d9c3ae23250978fe419d05b47d6a4fb7504db039e
SHA512b1109e136f95022a12e8bcda40d10174186746407cd72a0580ac50fb5420efe58bcc16fb59bb043cb3bac9b24c500c81b82add0c832c4eb3fb2dae808df66fc7
-
Filesize
204KB
MD5311a57c6d38edb521bdee6f29858b69d
SHA1a11b2a330e8e2085ea66a3cb4cb5c300d2cb75e3
SHA256e2393e3d6f206d34db3a50b47539c4cd4367c2787947a36eb6dd19585724a2e5
SHA51206dc8315af981434caab8870a7e61ebe983f5a047a0dfb81361211fa36aa7b6cb86fdbdcac431210dd823095faa662bfdbf2fe1bac61e844d96f4e50f336fcb3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB