Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/11/2024, 03:08
General
-
Target
c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe
-
Size
355KB
-
MD5
1c1b6dcfc35d55330d6c739a90ef7335
-
SHA1
3729f9fa7e25a486fecf14ade10c15fb8f2ed2c3
-
SHA256
c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381
-
SHA512
84af56b97f09d6b19037f5a9e3bef9120c2cb54c3008cc942d494ae896838563d8acb9b0f8ee6455d40486a9529e56f09033386f32eb02fef1f1e155043b4d71
-
SSDEEP
6144:T3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eim:gmWhND9yJz+b1FcMLmp2ATTSsdm
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe"C:\Users\Admin\AppData\Local\Temp\c148a2c656c5c6f64e989a6ea3bd50d93376056caed35650e4116f7147336381.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5cfa84e0f35ece58b7c44e3c3e2062be1
SHA10170a744d9bd527caf2f964c54dec482917b519e
SHA25695e79894abed97bff4ba7f3353e94a63b2b6df3721cabdd21567c1445c069660
SHA512c99f7789cb0ccab0cbe5de9b1876f12c5789d171881db10d369bb9dc12e0adc31b24a2ecf2950994c148ed3a700e0196f8021bbb4647558911d1cc21fc87197a
-
Filesize
1KB
MD5a7a9ac76bd532b69872dcb86eccce0c2
SHA15479d3f9e51c87a8af83d735541f70886bc51f30
SHA25677a9e9127487905a4d248fba40674ffa3bf56b986683319196d82f445cd08f80
SHA5121a625380a51fb26b426f089e6009c2107505d08cfee791992e27939a30d04a2531d101dfd25bc9c02d2a77850acf1207a6edf4daa4ad5d51a216a7780a7bdbce
-
Filesize
58KB
MD5000ecd714b82230461ed156096a86d65
SHA10503eab0922ba75d7b568e9fa9e7bbcd9293fdc5
SHA2566a21d780c50604fedd2f02f98b0f7fb93ee8c8ba308d7e8fab1204c3eb1f3a4c
SHA512cd7394869ed5980eb084997b60cd5bb8abdef436f6144930fb96f0d4ac2ef66ccc23692b602c61b8fc2db0a960cd0a53fc7cd619abbf5d020c49688a42ffd8ec
-
Filesize
42KB
MD5237489abefd13733b5538727e25cec5e
SHA1e2869806ad9e3056b74ef8f660bb7a70854b3af7
SHA256df5819b73b02fe91532573f0f4eabc05c57b2c09c0bc2dd0734b755bec2b2fff
SHA512647a811d4203d628a2cf69d62dd4b9b0d396d23e67d802ff1fbcc0648be9e2c37d273438fe04dbd69e48144a357f1af4b49995587a864f929be3a73faba6a81e
-
Filesize
355KB
MD54a88adcbbd793b2d7495173eac49b7a9
SHA177c84fe955e952c6a7370951976eed342bbff825
SHA256e0b3f9cb0fa24ba0855d24de5299e054ec086be25a304f8f99c1a4ab1aafa37b
SHA51296b3b7cb70b6c6338885f09ca519d386525490f5957e73915e2c362d02645e88aec17d60f0dcea2e6d776d44bec665e0c10d6f073f9205dd7b4196a92298e882
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB