Analysis

  • max time kernel
    1s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 12:12

General

  • Target

    fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe

  • Size

    375KB

  • MD5

    ebba842cec42bfbf785d647f750350e5

  • SHA1

    8aeb6aa599a57f1bc44e82e89e8bc786e7d37350

  • SHA256

    fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3

  • SHA512

    a614b24215bef8cce662ec971462ecb5fcad02192cd5102f402660e2c5776d48eb3235cb45a15b1f0aa98272eda41feae04d2318043414203912e3da55f9fab0

  • SSDEEP

    6144:F3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:qmWhND9yJz+b1FcMLmp2ATTSsdU

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe
    "C:\Users\Admin\AppData\Local\Temp\fe3041027299123787037554c04ac09c9637a6a8c902be9cfce2f2a4cd3e29e3.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\login[2].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\C5F5.tmp

    Filesize

    24KB

    MD5

    ba88e4e69697b0c887837eecf14989cf

    SHA1

    93f8d5bbc05eeb9309dc9fc1472835ba817a615a

    SHA256

    b9f0119b00acdca046f04f20bb027d3ed8ee8eb9091070f04030d1321628456f

    SHA512

    7434980822a357c7d1a3e6f8c75ec3e4112b6531ec03d690724034e92b0aa5325afdda2ce6cf16a26f36b3f6b02f151756d525dc606ca208e191356d11e76498

  • C:\Users\Admin\AppData\Local\Temp\CB50.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\F00B.tmp

    Filesize

    61KB

    MD5

    78a27738047fc1354d3f237934fcbd57

    SHA1

    dd8ae5640aa9b061261057748f7ed3af2f8f8016

    SHA256

    848a0211d9487e2c203deb019dc2d9440fc76c0b81d55747c8057b8205a1b7b0

    SHA512

    a47237f2643bad9971d7e7b090844d8af490e5cdcf6ea944d692ea42099e988f681c34230825f1dfcb2d2660612e6f4e2f17ad8de1ea9f6248a4704312eb3600

  • C:\Users\Admin\AppData\Local\Temp\F00C.tmp

    Filesize

    99KB

    MD5

    1b31a8d766c35df2194feb13fe1f0a07

    SHA1

    751459799355f6d3539d698f6759e17203ca394a

    SHA256

    5d3184fac1d25893118103860a51469f88c862a52214a7395951aa66dcf58230

    SHA512

    b737d92fe978acf167f87a3a980144105e16710bca941e2ed905d32f5338c20e7e7abdbb7f50c475d3477ea371c69e764da90d9a81ad0e131121ff32352573ce

  • C:\Windows\apppatch\svchost.exe

    Filesize

    375KB

    MD5

    cd30eaf74185cbaa6dfa39947eed55f9

    SHA1

    0b0515263a8535967dd21ba80b9eb5adf78266fe

    SHA256

    08cb49e51a4ef598392ed4a8a65e556946a70c43e072a6721069b5015005fae6

    SHA512

    a6bda6df4545da0a33e554f3c90bdd88b08f3c9055ea62e06b98deaa4d7c0ff5475480c03718ec6aa26ef5314396d00bde65e1b2259bf3e4fc4b5b72c2d1edda

  • memory/452-0-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/452-12-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1904-42-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-36-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-75-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-74-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-73-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-71-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-70-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-68-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-67-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-65-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-64-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-62-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-61-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-59-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-58-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-57-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-55-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-54-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-52-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-51-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-50-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-49-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-47-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-48-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-46-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-45-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-44-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-15-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-41-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-39-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-38-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-27-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-35-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-33-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-31-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-32-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-30-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-29-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-26-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-24-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-23-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-76-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-72-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-69-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-66-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-63-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-60-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-56-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-53-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-43-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-40-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-37-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-34-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-28-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-25-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-22-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-21-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-20-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-9-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1904-17-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-19-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1904-14-0x0000000002730000-0x00000000027D8000-memory.dmp

    Filesize

    672KB

  • memory/1904-186-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1904-187-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB