Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-11-2024 21:11
General
-
Target
7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe
-
Size
217KB
-
MD5
80360709ae2665f549b671272fbc0360
-
SHA1
e2f7e3d660abea58801c088a3c6b887d21b864e0
-
SHA256
7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7
-
SHA512
993b00a3439714657884fb512ae730960a93ba8e2d9dd37fa5b9736ed5a5c770ea6a29be55d4a3cb27c830270093977818356f5acc1b7cb958d6bdb34bd1d6c4
-
SSDEEP
6144:YrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:qsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe"C:\Users\Admin\AppData\Local\Temp\7519882ef9f78e61fa482179498a8978afac057cb64fc08b8ba589bddee1add7N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5791c6965535f4d18301d1c45327d6511
SHA15e1cdf055bb2667a8a1cd974e9930c9475e1ed98
SHA256d42c10714a1989fbeb2ad56633dc6b6dec49d3dbc13ef958a63cbf89ff8c2bbe
SHA51281a98a25b5031834ffb4aeccf900f53fd3744cb5ee4ed4c191367fce225fe2bec698b31912b554b8e056a536e181cc22fa792551af0cce404780f7985bbc67a8
-
Filesize
217KB
MD5f04cec2d5a3aff9b004bb2ea8e3ad3ab
SHA17dc91d8bdb8eb03ccc459b6193bce0b06f20afdd
SHA256c9ad63cbc5a4408cc8e738406155fc137b47d51bb9876799dbbe9ca489f1ecdb
SHA512776617ce4a2c0ade4b20382d65df6cfe938d60adf3603f8ede2a9202b7ad507bf17116def696d350075612e00eee25f648907f6e50658d64d87c74da650d5561
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB