Analysis

  • max time kernel
    2s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 07:03

General

  • Target

    7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe

  • Size

    355KB

  • MD5

    c2c4982c6a46e510263d27a14138b280

  • SHA1

    c366cc475dc6865ddd34112cf8979a454cdb84db

  • SHA256

    7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4

  • SHA512

    af7cace069e784201d30f64810be9f0f959f3b831ef7aa18ed0a5d20b3b200492e0ff886ef174a6e3d2c4b8cd52b1bb223ef427531e3c80688378ce8b911e7c1

  • SSDEEP

    6144:MgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei1:OmWhND9yJz+b1FcMLmp2ATTSsd1

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe
    "C:\Users\Admin\AppData\Local\Temp\7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\B3E0.tmp

    Filesize

    24KB

    MD5

    ed34eb4e43d607456b5b994df2fe5915

    SHA1

    0275a3d718405f87cd37c1941271b2d8846c716e

    SHA256

    864b3131e6b63208ac88ac5cf16fd9a20dc937ba7c2b7da5aa594f35dc0dfeca

    SHA512

    3ed18c0511c4e29f53adae38afc663b36755d0a9427932b00e9a58f985d43b108c5b427d4d8816bd6dc164bbb9e93407d7d4a9da6c8d5e4b70167d694616ee09

  • C:\Users\Admin\AppData\Local\Temp\B444.tmp

    Filesize

    1KB

    MD5

    63c589b3d653d13a20e6714a6590100a

    SHA1

    28be3c04c1d87ca59cce9c97d5d9d8e7614cdc85

    SHA256

    f49313be7b154463c67907dedaa313c80301fa8653e724ff51442c9d60022303

    SHA512

    7473ad65a2b23b986466b23b6a169653990c45b0ea55e21c810948eb153f3d16603ee9d3675b3d80c7523330b76fc7790acf8316c5ad1dae9334aa4d9e14108a

  • C:\Windows\apppatch\svchost.exe

    Filesize

    355KB

    MD5

    899660e74e2f318006b8709d46bf6e1a

    SHA1

    b499e11bb9c3fe742215f864c7a041d62fe7ba00

    SHA256

    485f88944a4ccf402271a2b2e09eff1e9eee69d5d6ad7c00343b31a35d56d3f4

    SHA512

    142c169dc69b2757753f5b313d9395064dea78c4b89ae57670325657c790c801642bd2c0ef6abd564bd7cbdb69ce2386b8f6b95df750f271d3c484167cfc4688

  • memory/1068-10-0x0000000003200000-0x00000000032A8000-memory.dmp

    Filesize

    672KB

  • memory/1068-13-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-16-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-14-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-28-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-73-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-72-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-70-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-68-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-67-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-65-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-64-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-62-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-60-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-59-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-57-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-56-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-54-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-53-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-51-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-50-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-49-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-48-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-47-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-46-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-45-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-43-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-42-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-40-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-39-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-37-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-36-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-34-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-32-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-30-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-27-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-25-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-23-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-22-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-71-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-69-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-66-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-21-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-63-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-61-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-20-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-58-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-55-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-19-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-52-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-44-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-41-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-38-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-35-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-33-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-31-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-29-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-26-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-24-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-18-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-17-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/1068-181-0x00000000033B0000-0x0000000003466000-memory.dmp

    Filesize

    728KB

  • memory/4564-9-0x00000000001D0000-0x000000000022F000-memory.dmp

    Filesize

    380KB