Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 22:38
General
-
Target
4888a8efd634014930634ac62e918fac43129f0d71064483ee179b2dccd8a4ef.exe
-
Size
217KB
-
MD5
31c3b82390da5a539ee3793a8a605133
-
SHA1
5cc2a39f27228386966624b04f1c90292896ecc4
-
SHA256
4888a8efd634014930634ac62e918fac43129f0d71064483ee179b2dccd8a4ef
-
SHA512
f05a6f80da8a72b0abace403798896bf074d887cb9c8669f16b9f80e92ec9c1ea8039ff6ba535c7eca42f61edbef9bcc93054057f61237ccc797c59f5bf2e92c
-
SSDEEP
6144:grRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:ysTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4888a8efd634014930634ac62e918fac43129f0d71064483ee179b2dccd8a4ef.exe"C:\Users\Admin\AppData\Local\Temp\4888a8efd634014930634ac62e918fac43129f0d71064483ee179b2dccd8a4ef.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD57fabffe3cfaa616fa65b9c878583cc06
SHA107ebe8c4606dff92ad8665c03cad329a3b09ac82
SHA25695dada9e66906ffc48b575a4dd88cc2066f157721b464c706c1f3ab8371c20f5
SHA51286304527e124654548c4bfb518beb1f67c00ff7b841ad98aaf9338889412574710cbfb9da98c3b5b10bdabdbf1bee7b7310a9e12a63ba6ee15e12c118ec3003d
-
Filesize
1KB
MD56206b4a590f79a320c06286890029cf0
SHA1ad30365532937d074d436342774af4b37dd56b0a
SHA256a0c06ff75929590371877392f516750b8b6b54363f05af38fe925bc415aea179
SHA512393dd16c6dc5d49c5dc583882c43b749f3dfde1dcb8645c51ae8b59bea78b83d70e32aa486244f0fd0a2771dca3198c9abbf67d0827e16c1713dacef1eaa1e9d
-
Filesize
1KB
MD5dea4854ff9db10983f96c00ed223fd5e
SHA127fd007fe5807060e23f1b9efebbd423cb73715b
SHA2569d261dc24e244f988814a8ac09cf5128d24c21d549c62ab8f7d7bce71faa6d55
SHA51281e0ba0457ee6232892222befaac419d1ee4d00ffa1f47785981bc066eb77666862d5d00a326de0d687a49b28db3dc624cc76b6c4094d2d059a7e2c07e6cb723
-
Filesize
217KB
MD58e21ce242b8821ab624fd6203878089e
SHA1b1e2228f4e0467c2b43296e65ef5507c6726b2d5
SHA256db6a80edd61a1770efe2b13e83ef1749f6b29638649b434d0aa100c256531839
SHA5120ee6966f8ce7a5e6234c0c7c2363b08891f7292985267d0a9d292818b684eda237892c9efbffc2de18a29a2f9272acea757cf2b12317371634aa4fbc85eb851a
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB