Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-11-2024 08:50
General
-
Target
0de3357304b3745b8e0c56ff03c4bf2328e79e17164c99bb45cba3a6536dfc58N.exe
-
Size
212KB
-
MD5
1d06b0a3e5145740a1255c480a43c460
-
SHA1
9800c61d4bfc7f95e7fd715c142e6bfa48be33a5
-
SHA256
0de3357304b3745b8e0c56ff03c4bf2328e79e17164c99bb45cba3a6536dfc58
-
SHA512
4997110b09aa6ab26c5e29b843756609ab15b3d3c371ecd41c41661912c839cfd3ad246561b86956c751e18ab7546fcd603d21115ed8b34e2d0e5bf880a25c8e
-
SSDEEP
3072:GGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:GG/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0de3357304b3745b8e0c56ff03c4bf2328e79e17164c99bb45cba3a6536dfc58N.exe"C:\Users\Admin\AppData\Local\Temp\0de3357304b3745b8e0c56ff03c4bf2328e79e17164c99bb45cba3a6536dfc58N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD59b5a68de3d87aeb7705b14e147587f29
SHA187c2bb26060aec473bdbbcb539d22e9b625c0833
SHA25695666ede05b08d5d30922eb34ac4c495be46f7c073ebbbaca0a838a33cb96d7d
SHA512e70adf30f489e80d820b754178d276fd8ba5f51bc2f39da792677854abe719cfd0a7f6e49c7af6fb8acc18dd64e6ed70a36b9c23d6c8ef403dc80eb7c4ebe180
-
Filesize
42KB
MD565b93108a1bb0e6ac5637b05c37f5f5f
SHA165ca82a1d351753445dd94b642669951f04c6baf
SHA2567ae5c75027888b2f11bd9621dd82960f85a6e978723d347652a621cff8d5fba8
SHA51272da60f2abb927b22cd734081f64e5f46d25c332bfc0a860ff62d2ff3d590553e86ffe85e1b69e4835bf8890c1a2ba1241024d29d04f9ea01e61fac7cad05ac3
-
Filesize
481B
MD5bb589326eebdfe05c8a203fb850c64c7
SHA110b79f029af5484ec672b1e7c7fe815caf636a1e
SHA256fde11326c6bfe6e498f9ff0db050b548947374d141f83b307efba2d68ce96ed9
SHA512db89047c9a8fd5793bfa5de5cecf09e6cde553d5ba522f7d3630bbf67ae973a0f7cc2040d12d27dcab70a07e966affbdfcef899bbf7ed8cf41e720d89beab00f
-
Filesize
212KB
MD528f280c5ec34f9b1112c4efcbbebef81
SHA1c11ef1ea69e6b708f9dd42a2a5524bb40b193648
SHA256e6152f4b77a3ecefcae47130dbacc421ad8e63864e19ed58efa55b9c1028327d
SHA512b468557d0daeeadacaec9222a3c99650465df33dce79873c98040435b79ffbab1d64553b3a8bd1c6e0304a5c15b4c5d54ca09e14226cf24f99d2f78a5e87705e
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.7MB