Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-11-2024 04:51
General
-
Target
efc145a3de488a0ba777e4836238558127673e8a6757ad06c38d2deafa8aa5af.exe
-
Size
212KB
-
MD5
351dfc379b03ed7ae674585207ea03b3
-
SHA1
e61db16ac456791a3780255cd02532fff808f97f
-
SHA256
efc145a3de488a0ba777e4836238558127673e8a6757ad06c38d2deafa8aa5af
-
SHA512
ed773bf3b011a740cc7601de995c951e1874070149785aa377520d1cafe0f4c68d4fd666083a39edb100a252eea85183818cd434848b93b8500256b697f797fc
-
SSDEEP
3072:lGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:lG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc145a3de488a0ba777e4836238558127673e8a6757ad06c38d2deafa8aa5af.exe"C:\Users\Admin\AppData\Local\Temp\efc145a3de488a0ba777e4836238558127673e8a6757ad06c38d2deafa8aa5af.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
1KB
MD5b41621f1a3bc87ae22fda0051aa9d812
SHA1873304639256e8f1e2281bc220fee7fd0ded7b9f
SHA256246231ef116b636f926cda967d1841c62bfc3e8e915d8356d4ce01b6b4bbbfdb
SHA51213f17a8b48063cc8787d1181169a4b7a165c6e7dfc276ff7fff2c7b5e1d95085e1b0cb96f611b73f17edba7dc147f24207696ca419cabe020d6cb4734b956607
-
Filesize
481B
MD58c27e3d4ce4b92780cd2f22758c934a0
SHA1d14648ec68b0f71dd044f6e4ce45fe18ad977ef6
SHA256029ec949d0dbb3ba0e59b2151326e02ec2503489b85e90fe258928e28b4ad9ba
SHA512d03ad25e6c223dfbbeef7ca1e9ad83bd0d192f19ea0a717ac5b68c80a37d9abaaa57bf7ba75d9583f8963c8b0b750cdc8c4c09cc1a4673a2dc095065b0b49be6
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD547d5c5a372409efa8ce76b260b0ae0d0
SHA1c210e7608f7e5da6298d07315019080604af97cc
SHA256e27f0067f9f0661b039db71578f79b5541e1c62b038cb69d65c15758ea116942
SHA512eca7a7e9e4adc737fc2ead115fcf36f4be071bc833d6668ac5d3638f05ef525036a24a7998ed787651c36504a4eb67d7351f4a6f2c7d306274d7d6a9ecd84176
-
Filesize
42KB
MD57a14070449a454e3466806af606a9e22
SHA159022c010cfdac1351ae64b1eb0615148e5579c9
SHA256fcaa0ada4ca6dae53bb7b139f23c1839421ad8c84fd5f0b1b879f92c86c7c0af
SHA5127a5b629cd11db5684476734f92ba29aae5a838c295671afcf5ff58c29fa234add0cb069dcf5f38e0b37c3e796b5b0de51500375af69d4ed34fcf459e842a6bcd
-
Filesize
42KB
MD5415ef72e860ede8bed53f8ce52b7895a
SHA1089faebe0887240f42d1da1d3ed0c98194e028cc
SHA256585a71b1c96e47b28f449a594dc76d1e87ae9ba8f3c3901508e72eb8a5211c4c
SHA512eb0c98f55cafdff0befa712a20ba3abb9c6a06722db96e2855cf14e23f49e15d8e81b73e7752861a60d06b2eb5a61468db2afa47aefc39b8124e2971e3b796b0
-
Filesize
212KB
MD58a70be5aa0d2ef0c06a46670e46c50f0
SHA1cd2f185c29e791ecb58f622ad0afa9638cdbc8f8
SHA2563da610cba84f4b94c3332d21d8674e08a73f155b17c9b433f0b71321ec18c701
SHA51210dc0a112b9297afd12463e20f5049fbad36a7ba0f29a7003d3d53f6ff4f553753019957868b66ca3c4bdb24f163193fc5585c320cbffb716578b99564949777
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB