Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/11/2024, 04:15
General
-
Target
cfc663d5ab467434a15e4ea8f972a39fa51eeb707ef91c4911a98bfc1aacc305.exe
-
Size
217KB
-
MD5
c33b0f74765d446d7591894642287a76
-
SHA1
fa765454cba65a81476c1dca8a75cf00dbc3807e
-
SHA256
cfc663d5ab467434a15e4ea8f972a39fa51eeb707ef91c4911a98bfc1aacc305
-
SHA512
98baa67991059eb2dcf7770dbba156c99eec761942d16e887486740a5a75bf05fc57a3c614c6aa661ac0e8cdcfbee6ad51ab4b725f2029fd07b3dbcc55fa2ea6
-
SSDEEP
6144:orRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:6sTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfc663d5ab467434a15e4ea8f972a39fa51eeb707ef91c4911a98bfc1aacc305.exe"C:\Users\Admin\AppData\Local\Temp\cfc663d5ab467434a15e4ea8f972a39fa51eeb707ef91c4911a98bfc1aacc305.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD50d74cfc3393a9d13255080cc3b3e7165
SHA1df820f0321f5164e9b48d1f60390f5ae0899f2ed
SHA256c7e720c0ce3cee3005fd0db9f10bca41f4a6c7125a9fe29336c58649d04070d3
SHA51233b99e5c04741f444c79a69380d98afdcd8882d573ed9dd195215e9ed2abc35263fa43e6c9f6da2e9c376ccbbfca12347af8a22a536b41596123c626b648197d
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5e1752f772b5c1ea60bb5dddc80c8115e
SHA129c0f029eda5e05b2508ae6bc8fafc099e2b2baf
SHA256d60f6408345e8ff95348bb6e66f67d5bd37d995b795906e87eb7405262791104
SHA5126937c9ade89cc86940db7cfef79802197769b72e75f402862ef2bcdbb1c4004eb853ec2249bb8c46e16ae4ae520b3e2f9b0b7fc9c0222f5fb4db19c441c1aafb
-
Filesize
42KB
MD5fb3725eeba6f06f8e4ad5328ed0d1e55
SHA1df363a6892acc77991b96b9fbf393e4a61ec778b
SHA256e43637d5dd531ea93aaf79e3241ab2f907e9a16622194252a4c28eafae303718
SHA512e91d4d0d9c6dce064f6786f01b289088493897af98a0eb9a115e765093d6fa4f8c171ac67f74b254cafa35929bf91b18eea186356f243548215f1e18d3138cbe
-
Filesize
217KB
MD59e543e584f82fe7b3573a4224fdfec18
SHA188da8c9dd3b225c738e05bc6152562bcef8e0348
SHA25619a95edc123fc220776bb0b805cd72f635f9340bcf7f88fbdd2f2f4b86adb320
SHA512216bc1f53acacd87a49daef30b78e07498e1911dd457cb2f05a621c48cc9b5d01c539202b5f89476b0e865e82fb44cea20393edfcd601112b5a1bf14c519f702
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB