Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-11-2024 00:29
General
-
Target
564f7822f3536e1ba4c555c4503de1d006845faeabc061c2d35b414a077b1d47N.exe
-
Size
212KB
-
MD5
02049fdd63a76506081acac3b7467060
-
SHA1
1b99c30f24c01fb46786239e8a212062b59f9469
-
SHA256
564f7822f3536e1ba4c555c4503de1d006845faeabc061c2d35b414a077b1d47
-
SHA512
b16e7206f2a9154efc6f51b367b6afa4aac92e81458a12cfc3f76233923bd28afce1d6a8942dc9f7be3f0d91e76fc5976114bd955bab6db949319eaeefb6db70
-
SSDEEP
3072:WGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:WG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\564f7822f3536e1ba4c555c4503de1d006845faeabc061c2d35b414a077b1d47N.exe"C:\Users\Admin\AppData\Local\Temp\564f7822f3536e1ba4c555c4503de1d006845faeabc061c2d35b414a077b1d47N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5fd322b6d29348aff2df624242c4150aa
SHA117fbd0f83978629c433be5b394cc9e86721ba9b6
SHA256ccc35b1d972ff10624f8fb7c1b413a087471515dd94635bf52f4ef59c140de28
SHA512b5d938d4c4146c391ea3d72df5a64b8cb04eac6bc11db8f5458e858050db33b3e097c75b461e44055b717915e176f61d349acfc5f93b16c1335c835433173b30
-
Filesize
24KB
MD5f229840524afa7594d61564229b6d957
SHA174d644be1e0f66f5ae1d0cd4d8787aa6547b4132
SHA2565ec711e319726c07b5451a35405c9fbad29bc3e715ed5ec6d69f33cfaa56d1f0
SHA5126a3f4c1c61af5cfc3f606bfedb0674bbf9b401b97319076b5b0912ed4c71fe8f8f751f1a3dd05edb200b9d9da61b4737ec7aeae44b818de252fa6c8c04e652c9
-
Filesize
1KB
MD555ec02ca721157149cb6553d3abe8c5c
SHA16b80346368c95ba2ee6291f528590bb6696f9b41
SHA25605bfb8f2b6c0310a8a202b91782c6d276881f22ca261f69ab375a518d00c26a0
SHA512db0176a314fe8edf8d9d1b9df595aa9b05b2f91e353f801f7dfab03324b226c61e0d6a29c339ea8952b675f6e4769caddbabdb68e27b4c350633c7d4101cab75
-
Filesize
61KB
MD5156b549608af8e1b5df1667f5857cc50
SHA1e325b9cc6053a652fa12018ab0c867ebfc290473
SHA2569075f6e4c01931fa4a18616024882e52824e6932d2c6ba5770774dc6555d016e
SHA512ac31e7dee45a79ce160b562da5172a996c03951ba1006fcbe82029c28985a1ffdad52654fe66e84e0f5e9698c8cdc055726fedccc3e51703e7030236e01f9cbf
-
Filesize
42KB
MD59dd97fde6f724eaf21dc8630c8b9e55e
SHA19bca3a7f9d6bff80c80e00a5ea867bd516b37707
SHA256434490c58be946dc74ece9c90f2143b5addf387307ef31dfe052b37c045e0327
SHA512f2e2b444eb9414d5cc68bf8fe0a5cff557a44fde7d057dc700f8db6f5e99389c35dc93a88e0076076d32613702fde5534baa67c303bb8f19d73314f31787d25c
-
Filesize
481B
MD523bae7bc613f51b31a9d1710842f96f2
SHA12fec818885040b2d333016ca779c9f86d88d68d6
SHA2566d402dcf78c0a7289ff1bc48681b4a88febc8556b08794319deab1a3fdeebe05
SHA5126e80888dbbe8e92d375cba8c5eba91e3302b00800146ebaa8bfe7a6f50ff63d72f2da44a414f05a2c7e0fb37c5d67e866faca41897c12ae91e7bb6592ae28b3f
-
Filesize
212KB
MD567855fc8edc45c8c5a7d5decba6aaac2
SHA1d537d1592e8555d136c73e7daa1b9df725e77592
SHA256a6c36cec6debb1da699f5cb542ddaee2f2832e8416ef759df75df8d7bf8e1f03
SHA5126efdbd28bda5e705f6cbfd8933d480df41f532df878b27132d1902af6f9fb40cd8784a792a79024015a0c2dc059a7511a26308190a0f9f3cee9e19008e80de16
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB