Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 03:51
General
-
Target
26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe
-
Size
686KB
-
MD5
c5d4e3780e463999211f6368d99f1980
-
SHA1
aa1c5134af638f9dac3cbe09061dfe012f3bcd14
-
SHA256
26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6
-
SHA512
0b1f8a890df364aa6677c424b15f2c513d964a5a5db7a2639249d163767f6a56ce483f504575fcc6a65491c71666180c7083a09d0ce70269fa8ef5eaf9dced66
-
SSDEEP
12288:SmWhND9yJz+b1FcMLmp2ATTSsdApVHyGbs2CYPHrLpVmCbHDSgpH:SmUNJyJqb1FcMap2ATT5itjCYZ3DSoH
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe"C:\Users\Admin\AppData\Local\Temp\26ff6ffd621619271508127787fc980696e8e31943bcda6417cc01930b12d7c6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5864b2c9be456c25c24eaca674f4d36d5
SHA12d63de23d3b924912ea7932e9315b0103007448e
SHA25626e8ab51498bd391ef6ec7fa7dc26dd980549ea0d802c076a4e89a3e45a2687f
SHA5128970180fa6f1ef8b18c1b7388feab5b85f2df00626e6187af7011245e93de95d2caf86784b7f596b300afb00cd1ee096f010ff29dc481e45c5576f4c154bd734
-
Filesize
1KB
MD58e9884a2ce3583c5d11b8a7bebb18c80
SHA100361336bd861462b3389ae2956c16b19bb6db1a
SHA256bc288c1ba9879a597a26ee488ce3396bc7669c32ebbeb919db2e1a0e23a6f4e8
SHA5121019d6081d9367fd21bebfb49f1379e35a8f1385b2c4a1599d63882f0673a06348df4bfcc28d0d3f6ad42eb8d2f1f2e4f87be4bb89ccad00b0eb37e29663bb39
-
Filesize
481B
MD5a4d9378b51390f876e6653799844f363
SHA17a68544875ebefcdf910dc1b70e5d7016433e6bf
SHA256edf569a79b50afe1eac45ba2b5e7a2fa5a1381b24fae526b0c2dca23bbfc4696
SHA5121a87cd79976a7d49d419e0c95a2cf214d1f457e1415bcf1266726dcf79f287dae5dce5b396bf308ab7b944f65cc7e3ebc6cb8c5d08229ded5cfa3d2cb0a27587
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
686KB
MD52f244b5e6c1432b8e74a03ec2cd6c370
SHA172ddf2f0c4cd42cbd49b3421071b70fd281f4532
SHA256cb784070c8703e1f131d855f47ac7213d7966ed72aaec722171da68da65c6ba6
SHA512eca5e49829fb3688bd5f82d684bd00c2a9725792c9f4b02d586fe8700146ea8c1f9dff6d00b4c96e832a3e5a91282da64e92934f66b02f88fc89576399f39ed0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB