Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 18:15
General
-
Target
a9d1edd0686b926d0555cbced1bf44a1d29dad74b60572591c4c6a2fa3572f4a.exe
-
Size
1.0MB
-
MD5
8f395cfe3c031eaa899db4a9372f71dd
-
SHA1
5be6b1f6f6f57ef5b02c275b2f3b2e775fb8753e
-
SHA256
a9d1edd0686b926d0555cbced1bf44a1d29dad74b60572591c4c6a2fa3572f4a
-
SHA512
bbef02d1fef857dc493005703cb554a156830b2fe97b6b7f48c6659190660e5521beecb9134ffbcb90c2115a4ef93c1f2393c237b364f6a2563fe7c3bd262eea
-
SSDEEP
24576:6mUNJyJqb1FcMap2ATT5qmUNJyJqb1FcMap2ATT5qmUNJyJqb1FcMap2ATT58:6mV2ApqmV2ApqmV2Ap8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9d1edd0686b926d0555cbced1bf44a1d29dad74b60572591c4c6a2fa3572f4a.exe"C:\Users\Admin\AppData\Local\Temp\a9d1edd0686b926d0555cbced1bf44a1d29dad74b60572591c4c6a2fa3572f4a.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD583c7dfc55b5c5a41deb37745172f3f85
SHA18b26f7e1588072a7996ec43c02607472bde996c5
SHA256758c1cd9c750aebc68ed08749b1a4dafaa07365e1b3b302d91ac8c3d3e7415d0
SHA5122878e7df5fc3508c254d2f6ad1334fb7c4677dbd436d5579b34c151b427dce8ff10a18e5d293339a7cc398ed94dc0c25b5241f30771f375d02a8f5e7447e8465
-
Filesize
24KB
MD5ee573beb4df1f9562c70535d478f099f
SHA1ed5c4976cf74697c693653fcf090cab23af2ef9b
SHA256ae2669ab2eccb0f4b7d100090af17f03315fbdde3770a3cee998b6aa2d656fcc
SHA5121a8c4e6d6d0b8dd04c304a56726d7f2ab2e8ee907472be436a01d8b85ce2cee13533ff7449d79dddd6d263fba1f213793165b63c7b40d013545f33a77e455e1c
-
Filesize
1.0MB
MD55345976173cee42570aff7d0126ddc93
SHA11921af4b3e4ad9f6c55cb518e63c7c52996fb9c0
SHA2564212e6ef43762ac6882315a30ed3ca3eca87e0b4d14014087b36b6c1a847c96f
SHA5129429c2bdfd6fad85a77491d624c3f458626eac52dc3b1e10a4ce1e6b54ebef12f668c20d356917b59823a326d15811f0dcc9bb49769c0d08f6273215c674ae23
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB